System and method for responding to aggressive behavior associated with wireless devices

ABSTRACT

An embodiment of the invention describes a wireless device comprising a Subscriber Identity Module (SIM) further comprising a memory for storing program code for performing a plurality of operations, and a processor for processing the program code to execute the plurality of operations, the operations including receiving over-the-air instructions via a wireless network from a control center to create a rules set in the SIM, wherein the rules set defines an acceptable behavior of the wireless device, monitoring requests from a wireless modem of the wireless device for access files stored in the SIM, detecting an aggressive behavior of the wireless device based on the rules set, and blocking the wireless modem from generating traffic in the wireless network.

CROSS-REFERENCE TO RELATED APPLICATIONS

The present application is a continuation of U.S. patent applicationSer. No. 14/189,847 filed Feb. 25, 2014 which is a continuation of U.S.patent application Ser. No. 13/948,916 filed Jul. 23, 2013, which claimsthe benefit of priority for prior U.S. Provisional Patent ApplicationNo. 61/746,468, filed on Dec. 27, 2012. U.S. patent application Ser. No.13/948,916 filed Jul. 23, 2013 is a continuation-in-part of U.S. patentapplication Ser. No. 13/766,622 filed on Feb. 13, 2013 and issued asU.S. Pat. No. 8,565,101 on Oct. 22, 2013, which is a continuation ofU.S. patent application Ser. No. 12/387,962 filed on May 7, 2009 andissued as U.S. Pat. No. 8,391,161 on Mar. 5, 2013. U.S. patentapplication Ser. No. 13/948,916 is also a continuation-in-part of U.S.patent application Ser. No. 13/544,497 filed on Jul. 9, 2012, which isthe non-provisional filing of 61/505,951 filed Jul. 8, 2011. U.S. patentapplication Ser. No. 13/948,916 is a continuation-in-part of U.S. patentapplication Ser. No. 13/670,191 filed on Nov. 6, 2012 issued as U.S.Pat. No. 8,531,972 on Sep. 10, 2013 which is a continuation of U.S.patent application Ser. No. 12/652,694 filed on Jan. 5, 2010 issued asU.S. Pat. No. 8,325,614 on Dec. 4, 2012. This application is also acontinuation-in-part of U.S. patent application Ser. No. 14/030,921filed on Sep. 18, 2013 which claims the benefit of prior U.S.Provisional Patent Application 61/714,083 filed Oct. 15, 2012. U.S.patent application Ser. No. 14/030,921 is a continuation-in-part of U.S.patent application Ser. No. 13/840,234 filed on Mar. 15, 2013 whichclaims the benefit of Provisional Patent Application No. 61/615,016filed on Mar. 23, 2012. U.S. patent application Ser. No. 13/840,234 is acontinuation-in-part of U.S. patent application Ser. No. 11/398,493filed on Apr. 4, 2006 and issued as U.S. Pat. No. 8,498,615 on Jul. 30,2013 which is a continuation-in-part of U.S. patent application Ser. No.11/119,401 filed on Apr. 29, 2005 and issued as U.S. Pat. No. 8,346,214on Jan. 1, 2013. U.S. patent application Ser. No. 13/840,234 is acontinuation-in-part of U.S. patent application Ser. No. 13/413,516filed on Mar. 6, 2012 and issued as U.S. Pat. No. 8,478,238 on Jul. 2,2013 which claims the benefit of Provisional Patent Application No.61/567,017 filed on Dec. 5, 2011. U.S. patent application Ser. No.13/413,516 is a continuation-in-part of co-pending U.S. patentapplication Ser. No. 11/804,582 filed May 18, 2007 and issued as U.S.Pat. No. 8,745,184 on Jun. 3, 2014, a continuation-in-part of co-pendingU.S. patent application Ser. No. 11/398,493 filed Apr. 4, 2006 andissued as U.S. Pat. No. 8,498,615 on Jul. 30, 2013, which is acontinuation-in-part of U.S. patent application Ser. No. 11/119,401filed Apr. 29, 2005 and issued as U.S. Pat. No. 8,346,214 on Jan. 1,2013. U.S. patent application Ser. No. 13/413,516 is acontinuation-in-part of U.S. patent application Ser. No. 11/119,401filed Apr. 29, 2005 and issued as U.S. Pat. No. 8,346,214 on Jan. 1,2013. U.S. patent application Ser. No. 13/840,234 is a continuation inpart of U.S. patent application Ser. No. 13/341,800 filed Dec. 30, 2011which claims the benefit of U.S. Provisional Patent Application No.61/501,131 filed on Jun. 24, 2011. U.S. patent application Ser. No.13/341,800 is a continuation-in-part of U.S. patent application Ser. No.12/652,694 filed Jan. 5, 2010 and issued as U.S. Pat. No. 8,325,614 onDec. 4, 2012 and a continuation in part of U.S. patent application Ser.No. 12/387,962 filed on May 7, 2009 and issued as U.S. Pat. No.8,391,161 on Mar. 5, 2013. U.S. patent application Ser. No. 14/030,921is a continuation in part of U.S. patent application Ser. No. 11/804,582filed May 18, 2007 and issued as U.S. Pat. No. 8,745,184 on Jun. 3,2014. U.S. patent application Ser. No. 14/189,847 is also acontinuation-in-part of U.S. patent application Ser. No. 13/341,800filed Dec. 30, 2011 which claims the benefit of U.S. Provisional PatentApplication No. 61/501,131 filed on Jun. 24, 2011, acontinuation-in-part of U.S. patent application Ser. No. 12/652,694filed Jan. 5, 2010 and issued as U.S. Pat. No. 8,325,614 on Dec. 4,2012, which is a continuation in part of U.S. patent application Ser.No. 12/387,962 filed May 7, 2009 and issued as U.S. Pat. No. 8,391,161on Mar. 5, 2013. U.S. patent application Ser. No. 14/189,847 is also acontinuation-in-part of U.S. patent application Ser. No. 11/804,582filed May 18, 2007 and issued as U.S. Pat. No. 8,745,184 on Jun. 3,2014, the entire contents of which are incorporated herein by reference.

FIELD OF THE INVENTION

Embodiments of the invention relate to services provided to consumersand operators of wireless networks.

BACKGROUND

The deployment of wireless networks is a very expensive proposition.There is a direct correlation between economics and network planning.One cannot have wireless networks of infinite capacity and bandwidth.Wireless networks are designed for the pre-determined capacity andperformance depending upon many factors such as geography, economics,demography, etc. All wireless networks have planned redundant or idlecapacity in advance to counter any bursts or unprecedented traffic. Thisplanning allows the operator to meet sudden demand without impacting theuser experience. Alongside, many network nodes can be running licensedsoftware which is directly proportional to planned network capacity andperformance. In a nutshell, wireless network resources are planned basedupon expected device behavior patterns.

If a wireless network observes step changes in utilization of networknodes by a handful of rogue or aggressive devices, negative networkperformance may manifest itself in various forms, such as servicedegradation, performance impact, network nodes running over plannedcapacity, service outage, etc. An example of such a rogue device is anaggressive mobile device. A mobile device shows aggressive behaviorswhen it is constantly trying to connect to a wireless network eventhough its service requests are repeatedly denied by the wirelessnetwork. A wireless network can deny or may be unable to cater to theservice requests due to any number of valid or invalid reasons. Forexample, the wireless network may be under maintenance, the user of themobile device has not paid the bill, certain network nodes in thewireless network are overwhelmed with service requests, the user has notsubscribed for a particular service that he is trying to access, etc.

Instead of looking into the reasons for service denial, an aggressivemobile device may act unintelligently by perpetually retrying toconnect. Such device behavior consumes excessive power in the mobiledevice, can cause an excessive signaling load on the wireless network,degrade the capacity and performance of the wireless network, and causeservice outages. Aggressive behaviors can trigger a chain reaction amongthe network nodes in wireless networks. As a result, certain networkservices may be degraded or even fail. Restoring the network services isa challenging and daunting task.

Aggressive behavior may be caused by any mobile device (e.g.,smartphone, Machine-to-Machine (M2M) device, etc.), including anyhardware/software/firmware modules in the mobile device; e.g., awireless modem, application and modem/modules driver script. Forexample, an M2M device may generally be considered a black box, whichmay be programmed once to run forever and does not require userintervention for its operation. It has been observed that a certainportion of M2M devices are implemented with a very aggressive serviceacquisition retry mechanism, which may result in network abusivebehavior. With continuous, repetitive attempts to acquire specificservice, these devices are occupying and wasting a large portion ofnetwork resources of the serving networks and the backendinfrastructure.

BRIEF DESCRIPTION OF THE DRAWINGS

The present invention is illustrated by way of example and notlimitation in the figures of the accompanying drawings, in which likereferences indicate similar elements and in which:

FIG. 1A is a block diagram of one embodiment of network architecture inwhich a mobile device may operate.

FIG. 1B is a block diagram of another embodiment of network architecturein which a mobile device may operate.

FIG. 2 is a block diagram of yet another embodiment of networkarchitecture in which a mobile device may operate.

FIG. 3 is a block diagram of one embodiment of a mobile device to betested and certified.

FIG. 4 is a flow diagram of one embodiment of a method for testing andcertifying a mobile device.

FIG. 5 is a block diagram of one embodiment of a mobile device includinga software agent.

FIG. 6 illustrates a flow diagram for an implementation of a rules setaccording to an embodiment of the invention.

FIG. 7 is a block diagram of one embodiment of a Signal Transfer Point(STP) including a software agent.

FIG. 8 is a flow diagram of one embodiment of a method for detecting andblocking the aggressive behavior of a mobile device.

FIG. 9 is a flow diagram of one embodiment.

FIG. 10 is a flow diagram of one embodiment.

FIG. 11 is a block diagram illustrating an embodiment of a wirelesscellular network with data network overlay.

FIG. 12 is a block diagram illustrating an embodiment of a networkswitching subsystem.

FIG. 13 is a block diagram illustrating an embodiment of a cellulardevice.

FIG. 14 is a block diagram illustrating an embodiment of a diagnosticdevice.

FIG. 15A is a diagram illustrating an embodiment of a network diagnosticdisplay.

FIG. 15B is a diagram illustrating an embodiment of a table ofcommunication data stream information.

FIG. 16 is a diagram illustrating an embodiment of a data popup window.

FIG. 17A is a flow diagram illustrating an embodiment of a process forupdating a network status display in response to an MSC location updateevent.

FIG. 17B is a flow diagram illustrating an embodiment of a process forupdating a network status display in response to an MSC location cancelevent.

FIG. 18A is a flow diagram illustrating an embodiment of a process forupdating a network status display in response to an SGSN location updateevent.

FIG. 18B is a flow diagram illustrating an embodiment of a process forupdating a network status display in response to an SGSN location cancelevent.

FIG. 19 is a flow diagram illustrating an embodiment of a process forupdating a network status display in response to a GSM Authorizationrequest.

FIG. 20A is a flow diagram illustrating an embodiment of a process forupdating a network status display in response to a PDP session startevent.

FIG. 20B is a flow diagram illustrating an embodiment of a process forupdating a network status display in response to a PDP session endevent.

FIG. 20C is a flow diagram illustrating an embodiment of a process forupdating a network status display in response to a CRD session endevent.

FIG. 21A is a flow diagram illustrating an embodiment of a process forupdating a network status display in response to a SMS message receivedevent.

FIG. 21B is a flow diagram illustrating an embodiment of a process forupdating a network status display in response to a SMS message sentevent.

FIG. 22 is a flow diagram illustrating an embodiment of a process forupdating a network status display in response to an authenticationfailure event.

FIG. 23 is a flow diagram illustrating an embodiment of a process forupdating a network status display with the current SIM status.

FIG. 24 is a flow diagram illustrating an embodiment of a process forupdating a network status display in response to an annotation event.

FIG. 25 is a flow diagram illustrating an embodiment of a process for anetwork status display to respond to a send SMS button click event.

FIG. 26 is a flow diagram illustrating an embodiment of a process for anetwork status display to respond to a send cancel location button clickevent.

FIG. 27 is a flow diagram illustrating an embodiment of a process for anetwork status display to respond to a diagnose button click event.

FIG. 28 is a flow diagram illustrating an embodiment of a process for anetwork status display to respond to a SIM information button clickevent.

FIG. 29 is a flow diagram illustrating an embodiment of a process for anetwork status display to respond to a zoom menu button click event.

FIG. 30 is a flow diagram illustrating an embodiment of a process for anetwork status display to respond to a date menu button click event.

FIG. 31 is a flow diagram illustrating an embodiment of a process for anetwork status display to respond to a time zone menu button clickevent.

FIG. 32 is a flow diagram illustrating an embodiment of a process for anetwork status display to respond to a refresh button click event.

FIG. 33 is a flow diagram illustrating an embodiment of a process for anetwork status display to respond to an OK button click event.

FIG. 34 is a flow diagram illustrating an embodiment of a process for asystem for diagnosing wireless communication systems.

DETAILED DESCRIPTION

In the following description, numerous specific details are set forth.However, it is understood that embodiments of the invention may bepracticed without these specific details. In other instances, well-knowncircuits, structures and techniques have not been shown in detail inorder not to obscure the understanding of this description. It will beappreciated, however, by one skilled in the art, that the invention maybe practiced without such specific details. Those of ordinary skill inthe art, with the included descriptions, will be able to implementappropriate functionality without undue experimentation.

The system and method described herein provide an immediate globalsolution for the aggressive behavior problems caused by mobile/wirelessdevices. In one embodiment, a cloud based control center (CC) utilizessoftware agents strategically placed within a Subscriber Identity Module(SIM) to monitor and/or control aggressive behavior of a mobile/wirelessdevice. In an alternative embodiment, software agents may bestrategically placed at Signal Transfer Points (STP) to monitor and/orcontrol aggressive behavior of mobile devices. An example of an STPincludes a Cisco IP Transfer Point (ITP). The Cisco IP Transfer Point(ITP) is a product for transporting Signaling System 7 (SS7) trafficover IP (SS7oIP) networks. The software agent at an STP monitors the SS7traffic on a per device basis based on, for example, deviceInternational Mobile Subscriber Identity (IMSI) number. In yet anotherembodiment, the aggressive behavior of mobile devices can be detectedand managed by the control center (e.g., the control center 280 of FIG.1B and FIG. 2) which maintains 24/7 running records of device behaviorin log files.

In either of the first two embodiments, the SIM software agent or theSTP software agent (collectively referred to as a “software agent”)reports aggressive behavior to the cloud based control center server.

In one embodiment, the software agent is able to compare known signaturebehavior of a mobile device to current data traffic patterns (per IMSI)to determine if the mobile device is acting aggressively. The signaturebehavior or patterns may be developed using a fully automatedself-certification process that is tailored to each type/category of awide range of mobile devices (including smartphones, M2M devices, etc.).The known device signatures are then compared to current data trafficpatterns (per IMSI) utilizing a sliding window concept, taking intoaccount the most recent data transmissions and expected future datatransmissions.

In one embodiment, after the software agent determines that a mobiledevice may be acting aggressively, the software agent communicates withthe control center and control center diagnostic processors diagnose anddetermine a proper course of action to mitigate the effects of theaggressive behavior. The control center then implements a solution byactively controlling various network nodes/elements, STP, Home LocationRegister (HLR), GPRS Support Node (GGSN), RADIUS, Short Message ServiceCenter (SMSC), etc., or the aggressive mobile device itself if needed.

In one embodiment, if the control center diagnostic processors determinethat the aggressive device must be controlled directly, the controlcenter can send over-the-air (OTA) instructions to a SIM appletoperating on the aggressive device to actively modify the aggressivebehavior. Alternatively, the control center can send over-the-air (OTA)instructions to the STP software agent to actively modify the aggressivebehavior transmissions emanating from the aggressive device.

Aggressive behaviors of mobile devices impact at least two broad areasof an operator's network: (1) GSM/SS7 signaling and (2) IP capacity/IPplane. Typically, the GSM/SS7 signaling impact is due to one or more ofthe following factors: purged or retired SIMs (e.g., SIMs removed fromthe HLR database), frequent power cycling of mobile devices (or SIMs)including M2M devices, the SIM is in a location in which it is barredfor service, chatty devices (e.g., smartphone applications request forradio resources asynchronously), jail-broken devices (e.g., a mobiledevice unlocked without operator's authorization, a mobile device thatruns uncertified applications, etc.), and application specificbehaviors.

Any of the above factors may cause an excessive number of SAI (SendAuthentication Information) Requests from the Mobile Switching Center(MSC) to the HLR, Location Update (LU)/Triplet Requests, and/or othertypes of network traffic. The areas of impact with respect to theGSM/SS7 signaling include HLR capacity and licensing, STP capacity, SS7cost, and other areas of the network system. For example, HLR licensingis based on volume of active devices per day. If a mobile device with apurged SIM still tries to attach to the network and consumes capacity ofthe network node, this mobile device will be counted as one activedevice for the purpose of HLR licensing even though the mobile devicecannot function properly with the purged SIM.

With respect to the impact on IP capacity/IP plane, the cause of suchimpact may include one or more of the following factors: wrong AccessPoint Name (APN), Domain Name Server (DNS) issues (APN context-resolveAPN), no traffic (e.g., device data does not reach the destinationserver due to IP routing issues in the Internet), frequent tearing downof a session at the device level (e.g., miscalculated device behavior tosave battery life, or medical devices that try to conserve radiocapacity, GGSN licensed for a given number of active sessions, etc.),frequent tearing down of accounting record by GGSN or RADIUS. The areasof impact with respect to the IP capacity/IP plane include: an excessivenumber of allowed Packet Data Protocol (PDP) context, an excessivenumber of denied PDP context, backlog in processing of billing recordsdue to capacity constraints, and other areas of the network system.

The following description provides the details of a system and methodfor detecting and resolving aggressive behaviors of mobile devices. Themobile device described herein can be a cellular telephone, a smartphonewith data transfer and messaging capability, a tablet computer, apersonal digital assistant (PDA), a video-camera, a gaming device, aglobal positioning system (GPS), an e-Reader, an M2M device (i.e., anapplication-specific telemetry device that collects data using sensorsand transmits the data to a destination such as a server over anetwork), a hybrid device with a combination of any of the abovefunctionalities, or any other wireless mobile devices capable of sendingand receiving voice, data and/or text messages.

FIG. 1A is a block diagram illustrating an embodiment of a wirelessnetwork system. In the embodiment shown, a mobile device 100communicates with an operator network 110 through a base station 102 anda base station controller 104. Mobile device 100 communicates withoperator network 110 using wireless protocols, such as GSM, 3GPP, (3G)UMTS, (4G) LTE, EDGE, Bluetooth, IEEE 802.11-based wireless protocols(e.g., Wi-Fi), and the like. Mobile device 100 may be used by a consumer(equivalently, a subscriber or a user). Operator network 110 is awireless cellular network that includes a voice network (e.g., a globalsystem for mobile communications (GSM) network), a data network (e.g., ageneral packet radio service (GPRS) network), and a messaging network(e.g., a short message service (SMS) network). It is understood thatoperator network 110 can include voice, data and messaging networks thatare different from the GSM network, GPRS network and SMS network. In theembodiment shown, the voice network is represented by a networkswitching subsystem 106, the data network is represented by a ServingGPRS Support Node (SGSN) 127, a Gateway GPRS Support Node (GGSN) 107,and the messaging network is represented by a messaging gateway 108. Itis understood that operator network 110 includes various other networkcomponents, which are omitted herein for simplicity of illustration.Operator network 110 allows a user of mobile device 100 to engage invoice, data and messaging communications with devices coupled tooperator network 110 through external networks (not shown).

In one embodiment, base station 102 includes a radio transmitter andreceiver for communicating with cellular devices (e.g., mobile device100), and a communications system for communicating with base stationcontroller 104. Base station controller 104 controls base station 102and enables communication with operator network 110. In variousembodiments, base station controller 104 can control any number of basestations.

Network switching subsystem 106 controls voice network switching,maintains a register of cellular device locations, and connects operatornetwork 110 with an external voice network, such as a public switchedtelephone network, a private voice telephony network, or any otherappropriate voice telephony network. In one embodiment, networkswitching subsystem 106 includes a mobile switching center (MSC) 111, ahome location register (HLR) 113, and a visitor location register (VLR)114. MSC 111 controls, sets up and releases a voice connection usingsignaling protocols such as signaling system No. 7 (SS7). In someembodiments, MSC 111 additionally tracks the time of a voice connectionfor the purposes of charging cellular devices, decrementing availableusage, tracking monetary balance, monitoring battery status, and otherpurposes. In one embodiment, operator network 110 may include any numberof MSCs. Each of these MSCs serves cellular devices within a networkarea, which may include one or more base stations and one or more basestation controllers. Some of the cellular devices may be registered touse this network area as their “home network,” and some of the othercellular devices may be registered to use other network areas as theirhome networks. HLR 113 maintains a list of cellular devices whose homenetwork is served by MSC 111. VLR 114 maintains a list of cellulardevices that have roamed into the area served by MSC 111. When acellular device leaves its home network (e.g., the network area servedby MSC 111), the VLR (“target VLR”) of the network (“target network”) towhich the device has roamed communicates with HLR 113 in the homenetwork of the device. When HLR 113 has confirmed to the target VLR thatit can allow the device to use the target network, the device is addedto the target VLR, and the MSC in the target network sets up thecommunication for the roaming cellular device.

SGSN 127 and GGSN 102 are two of the main components in the core datanetwork of operator network 110. SGSN 127 is responsible for thedelivery of data packets from and to the cellular devices within itsgeographical service area. The tasks of SGSN 127 include packet routingand transfer, mobility management (attach/detach and locationmanagement), logical link management, authentication and chargingfunctions. GGSN 107 controls data communications switching and connectsoperator network 110 with an external data network, such as a local areanetwork, a wide area network, a wired network, a wireless network, theInternet, a fiber network, a storage area network, or any otherappropriate networks. In some embodiments, GGSN 107 is one of the corecomponents in the core data network of operator network 110. Althoughnot shown in FIG. 1A, the core data network of operator network 110 mayalso include various other network switching components. GGSN 107 servesas an interface between operator network 110 and external data networks,and translates data packets into the appropriate formats for the deviceson each side. In the embodiment shown, GGSN 107 also performs policy andcharging enforcement and control via the functionalities of: Policy andCharging Enforcement Function (PCEF) 122, Policy and Charging RulesFunction (PCRF) 123 and Online Charging System (OCS) 124. PCRF 123performs policy control and flow-based charging control. To that end,PCRF 123 authorizes Quality of Service (QoS) resources and operations,e.g., service redirection and other policy-based actions. Ultimately,PCRF 123 resembles a collection controller in that it collects thesubscriber's subscription data and allows PCEF 122 to enforce thepolicies and the charging. OCS 124 facilitates the online chargingprocess by collecting charging information about network resource usageconcurrently with that resource usage. OCS 124 also approvesauthorization for the network resource usage prior to the actualcommencement of that usage. The approval may be limited in terms of datavolume or in terms of duration. PCEF 122 performs policy enforcement,service data flow detection, and flow-based charging functionalities.The policy control indicated by the PCRF 123 is enforced by PCEF 122. Tothat end, the PCEF 122 will permit the service data flow to pass throughPCEF 122 only if there is a corresponding active Policy and ChargingControl (PCC) rule and if OCS 124 has authorized credit for the chargingkey used for online charging. Ultimately, PCEF 122 ensures that serviceis provided with the appropriate QoS and that the subscriber is chargedin accordance with the charging rate set for the subscriber.

Messaging gateway 108 provides short messages transit between cellulardevices and other communication devices. Messaging gateway 108 can be aShort Message Service Center (SMSC), a multi-media messaging center(MMSC), or a network node coupled to the SMSC or MMSC. Messaging gateway108 delivers text messages through operator network 110 to/from externalnetworks via standard protocols such as Short Message Peer-to-PeerProtocol (SMPP) or Universal Computer Protocol (UCP).

In some embodiments, operator network 110 is coupled to a hosted serviceplatform 120 via a Core Service Platform (CSP) network 170 and a numberof network nodes. Hosted service platform 120 serves as a servicemanagement platform for wireless communication devices such as mobiledevice 100. Hosted service platform 120 may include multiple datacenters in multiple geographical locations with each data centerincluding multiple server computers. Hosted service platform 120includes a number of server computers (e.g., CSP engines 122) thatprovide a suite of functions to automate both the sales and supportprocesses towards wireless users. Hosted service platform and CSPnetwork 170, as well as software hosted thereon, form a CSP system.

CSP network 170 provides connections between the data centers in thehosted service platform 120 and operator network 110. In one embodiment,CSP network 170 includes a GGSN 171 that implements PCRF 173 and OCS174. Depending on the agreements between the operator/owner of operatornetwork 110 and operator/owner of CSP network 170, both sets of (PCRF123, OCS 124) and (PCRF 173, OCS 174) can be active at the same time orat different stages of service deployment. In some alternativeembodiments, CSP network 170 does not implement PCRF 173 and OCS 174.Instead, host service platform 120 collects subscription data, policyand charging information from operator network 110.

The network nodes between operator network 110 and CSP network 170 arerepresented in FIG. 1A as operator network node 130, network node A 131and network node B 132. These network nodes (130, 131 and 132) caninclude switches, routers, bridges, and other network components. Therecan be any number of network nodes between operator network 110 and CSPnetwork 170. In the embodiment shown, operator network node 130communicates with network node A 131 via an integrated connection, whileit communicates with network node B 132 via three separate connectionsfor voice, data and text messaging.

In some embodiments, an operator IT system 150 is coupled to operatornetwork 110 via operator network node 130. Operator IT system 150receives subscribers' data and usage from operator network 110, andprovides the functions of Customer Relationship Management (CRM)/care,provisioning/order entry, billing/mediation (or payments), andreporting/data warehouse (DWH) (or business intelligence). Operator ITsystem 150 also provides a user interface (such as a desktop interfaceor a Web interface) for a system administrator to monitor and managethese functions. In one embodiment, operator IT system 150 hosts CSPoperator Web applications 154. CSP operator Web applications 154 allowan operator to manage its marketing campaign, offers (equivalently, rateplans), pricing, billing and customer care in an integrated environment.

A CSP system, including hosted service platform 120, CSP network 170,and the software hosted thereon, interacts with operator network 110,operator IT system 150, and mobile device 100 in real time. Through CSPdevice application (CDA) 140 and CSP operator Web applications 154, theCSP system provides or enables the functions of on-device application,self-care, diagnostics, store-front, alert management, policy control,payment handling, offer management, campaign management, analytics,reporting engine, and data rating.

Although the wireless network system hereinafter is described in thecontext of 2/3G Global System for Mobile Communication (GSM) networktechnology, it is understood that other network technologies, such asCode Division Multiple Access 2000 (CDMA2000), 4G Long Term Evolution(LTE), LTE Advanced, etc., can be used to support the techniquesdescribed herein. It is also understood that embodiments of theinvention can be adapted to work with future versions of the networkprotocols, technologies and standards as these protocols, technologiesand standards develop.

The wireless network system of FIG. 1A may be deployed globally toprovide services to multiple network operators. In the embodiment to bedescribed below in connection with FIG. 1B, a control center may includeand perform the functions of the hosted service platform 120 of FIG. 1A.The control center is coupled to a global platform provider network,which may include and perform the functions of the CSP network 170. Theglobal platform provider network is further coupled to one or moreoperator networks operated by one or more network operators (alsoreferred to as network carriers).

Referring to FIG. 1B, a global platform provider operates to providenetwork services to mobile devices (e.g., the mobile device 100 of FIG.1A) that may roam from one partner carrier network to another partnercarrier network. The global platform provider is allocated with a set ofmultiple subscriber identifiers, such as the international mobilesubscriber identifier (IMSIs). Although IMSI is used in the followingdescription, it is understood that other subscriber identifier types canbe used instead of IMSI.

The mobile device 100 having one of these IMSIs programmed in its SIMcan avoid or reduce its roaming charges in regions that are operated bynetwork carriers partnered with the global platform provider. The mobiledevice 100 may incur temporary roaming charges after leaving its homenetwork and entering a partner carrier network (e.g., partner carriernetwork 4480 or 4490). However, at some point in time when one or morepre-determined allocation rules are satisfied, the mobile device 100 canbe provisioned with a new IMSI that is local to the partner carriernetwork or an IMSI that is predetermined by the global platform providerto be preferred for that visited country. With this new IMSI, the mobiledevice can transmit and receive wireless packets in the partner carriernetwork without incurring roaming charges and without having thetransmissions routed through its home network.

The determination of whether the mobile device 100 can switch to a localor otherwise preferred IMSI can be made by a control center 280 based ona set of allocation rules. The control center is coupled to a globalplatform provider network 4400 and includes at least a provisioningserver 4450 and an over-the-air (OTA) server 4440. Both the controlcenter 280 and the global platform provider network 4400 are operated bythe global platform provider.

The control center 280 and the global platform provider network 4400 caninclude multiple servers, multiple storage devices and multiple networknodes distributed across multiple geographical areas.

In one embodiment, the global platform provider network 4400 includes aHLR 4430 that includes one or more servers and databases for managingand storing mobile subscriber information. The mobile subscriberinformation includes the IMSI, the MSISDN, location information (e.g.,the identity of the currently serving Visitor Location Register (VLR) toenable the routing of mobile-terminated calls) and service subscriptionand restrictions. The HLR 4430 is coupled to an authentication center(AuC) 4431 for performing authentication of a mobile device thatrequests a network connection.

The HLR 4430 is operated and updated by the global platform provider.The HLR 4430 communicates with the partner carrier networks (4480, 4490)via Signaling System 7 (SS7) messages through Signal Transfer Points(STPs) (4471, 4472), or via Internet Protocol (IP) messages throughMobility Management Entities (MMEs). The SS7/IP messages can be sent viadedicated SS7/IP connections and/or SS7/IP inter-carrier networks 4441.In some embodiments, the HLR 4430 shown herein is a logicalrepresentation. Physically, the HLR 4430 can be distributed acrossmultiple geographical areas. In some embodiments, the HLR 4430 caninclude distributed segments of the HLRs owned by multiple partnercarriers. Thus, in these embodiments the HLR 4430 can be the sum ofmultiple HLR segments, with each HLR segment owned by a differentpartner carrier. For example, a partner carrier may own and operate anHLR, and a segment of the HLR can be read and updated by the globalplatform provider. The updates performed by the global platform providercan include adding/provisioning and removing/purging IMSIs, and settingand editing subscriber wireless service permissions. The IMSIs that canbe added and removed by the global platform provider are within a set ofIMSIs that are allocated to the global platform provider. That is tosay, the HLR 4430 stores and manages the IMSIs that belong to the set ofIMSIs allocated to the global platform provider. In one embodiment, whena new IMSI is provisioned to a subscriber, the subscriber may also bechanged to a new billing account owner. That is, the contractualownership for the subscriber's wireless service may change with theprovision of a new IMSI. After the provision of a new IMSI, thesubscriber may receive a billing statement from a new partner carrier inaddition to or instead of the original carrier.

In the embodiment of FIG. 1B, each of the partner carrier networks(4480, 4490) includes one or more MSCs (4485, 4487) and one or moreSGSNs (4415, 4417). The MSCs (4485, 4487) are responsible for routingcircuit-switched voice calls, fax, data and short message service (SMS).The MSCs (4485, 4487) can forward outgoing circuit-switched signals froma mobile device to a circuit-switched network (not shown), and canforward outgoing short messages to an SMS center (SMSC) 4460. Thecircuit-switched network and the SMSC 4460 then deliver thesignals/messages to their intended destinations. In addition, the MSCs(4485, 4487) are responsible for requesting the HLR 4430/AuC 4431 toauthenticate a mobile device when the mobile device requests for anetwork connection.

The SGSNs (4415, 4417) are responsible for routing data packets. EachSGSN (4415, 4417) is identified by an Access Point Name (APN), which canbe used in a Domain Name Server (DNS) query to resolve the IP address ofa GGSN (e.g., GGSN 4416) that serves the SGSN (4415, 4417). The APNresolution function is shown as the APN DNS (4465, 4467). The GGSN 4416then delivers outgoing data packets from the mobile device 100 to theirdestination(s) via a packet-switched network (e.g., the Internet).Before granting access to the packet-switched network, the GGSN 4416 canuse Remote Authentication Dial In User Service (RADIUS) protocol toprovide Authentication, Authorization, and Accounting (AAA) management(shown as RADIUS 4418). For incoming data packets destined for themobile device 100, the GGSN 4416 resolves the IP address of thedestination SGSN using the SGSN's APN in a DNS query (shown as the APNDNS 4466). The communication between the SGSN (4415, 4417) and the GGSN4416 can be provided by a GPRS roaming exchange (GRX) network 4442 forinter-carrier connections. In some embodiments, the communicationbetween the SGSN (4415, 4417) and its associated GGSN can be provided byan intra-carrier connection.

In the embodiment of FIG. 1B, the HLR 4430, the SMSC 4460, the GGSNs4416 and the RADIUS 4418 are within the global platform provider network4400. In alternative embodiments, one or more of the HLR 4430, the SMSC4460, the GGSNs 4416 and the RADIUS 4418 can be located within andoperated by one or more of partner carrier networks (4480, 4490).Regardless of their locations and ownership, the control center 280 hasaccess to each of the HLR 4430, the SMSC 4460, the GGSNs 4416 and theRADIUS 4418 to manage the information of the mobile subscribers, whodirectly or indirectly (e.g., through a partner carrier, or through acustomer organization having a contract with a partner carrier or withthe global platform provider) subscribes to the service of the globalplatform provider.

Having described the network environments in which a mobile device mayoperate, the following discussion describes systems and methods fordetecting and handling aggressive behaviors of mobile devices accordingto embodiments of the invention. In order to acquire specific networkservices, a mobile device interacts with the wireless networkinfrastructure on various network events. If any of these network eventsis occurring in excessive numbers, the mobile device will be consumingnetwork resources above the amounts dimensioned according to bestpractices, and may bring the network to resource exhaustion and causewidespread service impacts. The network nodes or resources that may beimpacted by the aggressive behaviors of a mobile device include, but arenot limited to: STP, HLR, GGSN, RADIUS, SMS and GRX, as well as thestorage and CPU of the network processors in these network nodes.

The types of network events and event frequencies that are considered tobe aggressive behaviors may depend on the purpose of the mobile device.Although some behaviors cannot be tolerated no matter what the businesspurpose of the mobile device is, it is noted that mobile devices aimedfor different purposes are typically expected to have differentbehaviors. What may be considered an aggressive behavior for a mobiledevice with one business purpose (e.g., a smartphone) may not beaggressive for another mobile device (e.g., M2M device). Thus, thecriteria or rules for detecting aggressive behaviors need to be tailoredto the purpose of the mobile device. In order to determine thesecriteria or rules appropriate for a given type or category of a mobiledevice, the mobile device may need to undergo a self-certificationprocess such that its signature behavior can be determined.

Network events triggered by aggressive behaviors may occur either whilea service request is made (i.e., before the service is rendered) orafter the service is granted. Those network events that occur while aservice request is made include, but are not limited to: a mobile devicewhich is GSM barred (i.e., disallowed to access the GSM service) on anetwork and is trying to perform GSM registration, a mobile device whichis GPRS barred on a network and is trying to attach to GPRS dataservice, a mobile device is in a barred location of a network and istrying to perform GSM or GPRS registration, a mobile device is trying toregister to a wireless network against the recommended Public LandMobile Network (PLMN) order on its SIM, etc.

Those network events that occur after the service is granted include,but are not limited to: a mobile device that sets up and tears down avoice/data session very frequently, synchronized activities such as alarge number of mobile devices programmed to generate traffic at thesame or substantially the same time, a mobile device that sends burstsof mobile originated (MO) SMS messages in a short period of time, burstyInternet Protocol (IP) traffic, a mobile device application that triesto steer the traffic against a network preference, etc.

To detect the occurrence of the aggressive behavior of a mobile device,the mobile device's signature behavior may need to be qualified first.During field operation when the behavior of the mobile device deviatesfrom the signature behavior, a trigger is generated to signal thedetection of an aggressive behavior. The trigger may be generated by themobile device, by one of the network nodes (e.g., STP) or by the controlcenter processors/servers. In one embodiment, the signature behavior ofa mobile device may be qualified by an automated self-certificationprocess. The self-certification process is a process in which a customerruns field scenarios on his mobile device. The customer can be an enduser; alternatively, the customer can be a provider of mobile devices.

To start the self-certification process, a customer logs onto a webportal provided by the control center. The customer connects his mobiledevice to the wireless network such that the mobile device's behavior onthe wireless network can be tested. The results of the test can bevisualized on the web portal.

A system architecture for supporting the certification process accordingto one embodiment is illustrated in FIG. 2. In this embodiment, thecontrol center 280 is communicatively coupled to a test computer 250over a wireless network 230 operated by a wireless service provider. Thecontrol center 280 may also be coupled to the test computer 250 throughan Internet connection 260, if one is available. This Internetconnection is sometimes referred to as a “direct channel” between thetest computer 250 and the control center 280. The control center 280includes a plurality of servers for implementing the various functionalmodules 204, 205, 220, 221, 222, 255 and 270 illustrated in FIG. 2(e.g., by executing program code designed to perform the variousfunctions). The control center 280 also includes a plurality ofdatabases 210, 211, 212 and 275 for storing data related to users andwireless devices.

In operation, a prospective wireless data customer visits a web portal201 hosted by the web server 255, and requests a trial SIM for a mobiledevice under test through a web-based graphical user interface. Anexample of the mobile device is the mobile device 100 of FIG. 1A andFIG. 1B. Via the user interface, the customer selects a wireless moduleto be tested, enters contact information (e.g., user name, address,etc.), account information (for specifying a user name and password fora new user account), a referral code, payment information (e.g., creditcard data), billing information, and shipping information. In oneembodiment, the web portal 201 includes data verification logic toensure that the data entered in the various data fields is in thecorrect data format. In addition, in one embodiment the web portal 201includes a connection to a credit card issuer system to verify thecredit card payment information entered by the customer. While variousdifferent platforms may be used to implement the web portal 201 (andother Web-based user interface features described herein), in oneembodiment, the web portal 201 is provided by an Apache Tomcat webserver running on Linux with software programmed in Java using an Oracledatabase.

Upon entering all requested information, the web portal 201 verifies thetransaction and transmits the user and device data to a registrationsystem 205. In one embodiment, the registration system 205 exposes anApplication Programming Interface (API) to the web portal 201 and theweb portal 201 communicates data to the registration system 205 usingthe API. The interactions between the web portal 201 and theregistration system 205 may be formatted as a Web services-basedtransaction, with user data embedded in one or more Extensible MarkupLanguage (XML) files using the SOAP protocol. However, various otherdata communication protocols may be employed while still complying withthe underlying principles of the invention.

In response to receipt of the user data, the registration system 205establishes a new user account and executes a series of databaseoperations to open new record(s) in a user database 210 and an accountsdatabase 211. For example, the user's name and contact information maybe stored in the user database 210 and a new account may be opened forthe user in the accounts database 211 (including an account number,wireless device profile, wireless device identification codes, etc.). Inone embodiment, the various databases shown in FIG. 2 are not actuallyseparate databases but, rather, separate data structures (e.g., tables)within a single relational database.

In one embodiment, a device management system 204 automaticallyprovisions SIMs on behalf of the user within a wireless device database212. As part of the provisioning process, an identification code foreach SIM is automatically associated with data services offered by thewireless service provider. Each SIM includes a unique serial number,international unique number of the mobile user (e.g., IMSI), securityauthentication and ciphering information, temporary information relatedto the local network, a list of services to which the user is providedaccess and password data. In one embodiment, the SIMs are initiallyprovisioned with limited functionality for application development andtesting purposes. For example, in one embodiment, data transmissionthresholds are set to limit the amount of data which the SIMs mayutilize during the testing period. In addition, in one embodiment, theSIMs are provisioned to operate only for a specified time period. At theend of the time period, the SIMs are automatically disabled and/orde-provisioned and will no longer be permitted access to the wirelessservice provider network. In an alternative embodiment, the SIMs areprovisioned with full functionalities ready for field use.

As part of the provisioning process, the SIMs are automaticallyregistered with the HLR 221 of the wireless service provider 230. An HLRis a central database containing details of each mobile data subscriberauthorized to use the wireless network. While the HLR 221 is illustratedin FIG. 2 within the domain of the control center 280, in oneembodiment, the HLR 221 communicates with a central HLR maintained bythe wireless service provider. Alternatively, in one embodiment, theentire HLR 221 is maintained by the service provider and the serviceprovider is provided access to the data stored within the wirelessdevice database 212 during the provisioning process. The underlyingprinciples of the invention are not limited to any particularHLR/database configuration.

Following the automatic provisioning of the SIMs and registration of theuser, the owner/operator of the control center 280 sends a wirelessdevelopment kit to the user containing one or more SIMs with applicationsoftware (referred to as testing and monitoring program code) andinstructions for testing, configuration and certification. After thecustomer receives the SIMs, he can log into the web portal 201 to startthe self-certification process. In one embodiment, the testing andmonitoring software may be installed on the test computer 250;alternatively, the testing and monitoring software may be installed onthe mobile device 100.

The self-certification process includes testing one or more of thefollowing certification scenarios: purge the SIM from the HLR, place arestriction on the SIM such that all operators are blocked, place arestriction on the HLR with respect to which operators are allowed ornot allowed for the SIM, change the network access mode of the SIM(sometimes referred to as “NAM the SIM”) with “GSM not allowed,” changethe network access mode of the SIM with “GPRS not allowed,” cause theSIM to establish connection with the wrong APN, and cause the mobiledevice to perform one or more of the following: send traffic to adestination server whose IP is blocked by the control center operator'sfirewall, send traffic to a destination server which has either crashedor gone down, be unable to identify the destination server IP addressusing the DNS, send the content to a destination server when the serveris overloaded or the response is delayed, send the content to a wrongserver port, send a mobile originated (MO) SMS and expect anacknowledgement in mobile terminated (MT) SMS which is not working, sendan MO message to a Short Message Peer-to-Peer (SMPP) client's short codewhen the SMPP client is down, switch off when the SMPP client is tryingto send a message to the mobile device, and send multiple SMS messagesin quick session with no back-off.

For each of the certification scenarios, the web portal 201 providesdetailed instructions and progress of the certification for display onthe customer's test computer 250. If there is any setup issues, probablecauses and remedies are also displayed. After the customer completes allof the necessary tests, he will be given a certificate instantly fromthe web portal 201 (e.g., via email or other electronic delivery means).The results of the certification are analyzed to generate the criteriaor rules that define the signature behavior of the mobile device 100. Insome embodiments, pictorial analytics of the device behavior may beshown on the display of the test computer 250.

As illustrated in FIG. 3, one embodiment of the mobile device 100 is awireless device 301 with a Universal Serial Bus (“USB”) interface 312for connecting to the USB port of a standard computer system (e.g., thetest computer 250 of FIG. 2). In an alternative embodiment, the mobiledevice 100 may be an independent, stand-alone wireless device such as aWindows Mobile device, and the testing and monitoring program code maybe executed directly on the mobile device 100 (e.g., loaded fromnon-volatile to volatile memory and executed by the mobile device'sprocessor). Consequently, there is no need for an additional computersystem executing the testing and monitoring program code in thisalternative embodiment.

Although an USB interface is described herein, it is understood that theunderlying principles of the invention are not limited to any particularinterface type. Other interface types which may be used in lieu of USBinclude, by way of example and not limitation, IEEE 1394b (“Firewire”)and eSATA. For simplicity, the following discussion will refer to a USBdevice 301; however, the wireless device 301 may be any type of wirelessdevice without limitation.

In one embodiment, the test computer 250 is a Windows-based computerwith an Intel® Core-2 Duo®, Core i7®, or similar x86-based processor,2-4 GBytes of DDR2 or DDR3 memory, and a 250 GByte (or larger) SerialATA hard drive. Various other computer configurations may also be usedwhile still complying with the underlying principles of the invention.For example, in one embodiment, the test computer 250 is a Macintosh®computer system such as a Macbook Pro® or Mac Pro® desktop.

One embodiment of the USB device 301 includes a flash memory 304 forstoring testing and monitoring program code 305. The flash memory 304may be integrated directly within the USB device 301 or may take theform of a memory card coupled to a memory card slot within the USBdevice 301 (e.g., a Secure Digital card slot). In one embodiment, theUSB device 301 includes a wireless modem module 310 pre-configured tocommunicate over the wireless network and a SIM interface into which thepre-provisioned SIM 311 may be connected for configuring, testing anddebugging wireless applications. Once inserted into the SIM interface,the SIM 311 authorizes the USB device 301 to communicate over thewireless service provider's network 230 (according to the provisioningparameters associated with the SIM 311).

In one embodiment, when the USB device 301 is initially inserted intothe USB port of the test computer 250, auto-installation logic (e.g., anautomatic installation script) is executed and (upon authorization bythe end user), the testing and monitoring program code 305 isautomatically installed and executed on the test computer 250.

In an alternative embodiment, the mobile device 100 may be anindependent, stand-alone wireless device such as a Windows Mobiledevice, and the testing and monitoring program code 305 may be executeddirectly on the mobile device 100 (e.g., loaded from non-volatile tovolatile memory and executed by the mobile device's processor).Consequently, there is no need for an additional computer systemexecuting the code 305 in this implementation.

In the embodiment of FIG. 3, the USB device 301 is preconfigured withthe Access Point Name (APN)—i.e., the network address used to identify aGGSN 222 at the control center 280. During the testing and configurationprocess, all wireless cellular communication with the control center 280is routed through the GGSN 222. In addition to the APN, the USB device301 is also configured with the hostname of the control centerdiagnostics system 270, which includes one or more test servers used forIP traffic testing.

In one embodiment, the provisioning parameters for each SIM include acommunication profile specifying the wireless services allocated to theSIM (e.g., whether SMS or voice functionality is permitted, roamingrestrictions, etc.). The provisioning parameters also include the rateplan associated with the SIMs including the financial parameters (i.e.,the price), the amount of data permitted under the financial parameters,overage rates, etc. As previously described, in one embodiment, eachtrial SIM is allocated a limited amount of data usage for testing andtroubleshooting purposes, and is not provided with voice or SMScommunication services. In one embodiment, even though the SIM is notprovisioned for voice service, the SIM is provided with GSMfunctionality in order to be authorized with GSM network, prior toconnecting to the GPRS network. In another embodiment, the SIM may beprovisioned with voice, data, and/or SMS communication services.

The testing and monitoring program code 305 can automatically establisha connection with the control center 280 over the wireless cellularnetwork 230 and/or a direct channel through the Internet 260 andexecutes a series of automated tests, thereby saving the end user asignificant amount of time and effort in the process of developing newwireless applications. Moreover, because the SIMs received by the enduser are pre-provisioned and the USB device 301 may be pre-configured bythe control center 280, the USB device 301 is capable of establishing awireless connection with minimal effort on the part of the prospectivecustomer.

In one embodiment, the testing and monitoring program code 305automatically checks for updates prior to executing the various testsand troubleshooting steps. The updates may include patches andadditional tests/troubleshooting operations. If an update is available,the testing and monitoring software automatically installs the update(upon confirmation by the end user) and then executes the tests.

One embodiment of a computer-implemented method for the mobile device100 to perform the self-certification process is illustrated in FIG. 4.At step 401, the testing and monitoring program code 305 tests theprovisioning of the USB device 301 with a particular SIM installed. Inone embodiment, this involves checking the following parameters todetermine whether traffic is allowed using the given SIM: the SIM'sstate must be “Activation Ready” or “Activated;” (b) the SIM must nothave been blocked. An activation ready state allows a SIM to be ready tobe activated. An activation ready state will authenticate and authorizewith the HLR and AAA server of the provider system, but no billing willoccur. An activated state allows a SIM, or a device with a SIM, to beused by a user. In an activated state the SIM will authenticate andauthorize on the HLR and AAA server of the provider system. Billingcommences immediately on changing to this state.

Assuming that the foregoing conditions are met, the USB device 301 withthe SIM passes the provisioning test step 401. A test failure indicatesthat one or more of the foregoing conditions were not met. For example,if the SIM's state is not “Activation Ready” or “Activated,” or if theSIM has been blocked due to excessive signaling or excessive data usage,then the USB device 301 with the SIM 311 will fail the provisioning step401. In response, one embodiment of the testing and monitoring programcode 305 performs troubleshooting operations to fix the problem and/ornotifies the user of troubleshooting steps to be taken. For example, ifthe SIM's status is not “Active” or “Activation Ready” then the testingand monitoring program code 305 may check to ensure that the SIM'sstatus is correctly reflected in the wireless device database 212.

At step 402, the testing and monitoring program code 305 tests the USBdevice 301 and the SIM 311. In one embodiment, this test involvesdetermining whether the given USB device 301 and SIM 311 are availableon the network based on one of two factors (whichever comes first): (a)reporting from the device via “direct channel” diagnostics, or (b) anydetected wireless signaling activity. With respect to (a), the directchannel comprises the direct connection of the test computer 250 to thediagnostics system 270 through the Internet 260. In one embodiment, thetesting and monitoring program code 305 reports its status to thediagnostics system 270 periodically through the direct channel. Thesereports may include local wireless statistics such as signal strengthand data usage. If the USB device 301 is unable to connect wirelesslydue to lack of coverage or low signal strength, the direct channelprovides valuable diagnostic information that would otherwise beunavailable to the diagnostics system.

If a direct channel connection or wireless connection is detected, thenthe USB device 301 and SIM 311 pass the device/SIM testing step 402illustrated in FIG. 4. In one embodiment, if neither connection isdetected, then troubleshooting steps are implemented includinginstructing the user to confirm that the SIM 311 is inserted properlyand determining whether wireless coverage exists at the test location.For example, in one embodiment, the control center 280 and/or thetesting and monitoring program code 305 maintains a database of servicecoverage locations. If the current location of the wireless device isoutside of the coverage location, then the testing and monitoringprogram code 305 may notify the user that coverage is not available atthe current location. The user's current location may be determinedmanually (e.g., by requesting the current address or zip code for theuser) or automatically (using GPS if the customer's test computer 250 isequipped with GPS capabilities).

The customer may also be asked to verify that the USB device 301 hasadequate signal strength (e.g., greater than 1 bar or a RSSI of 5 ormore); verify that the device's antenna is properly connected; verifythe USB device 301 is configured with the proper frequency bands (850 &1900 MHz for the US, and 900 & 1800 MHz for Europe); and/or verifywhether other wireless devices (e.g., GSM/GPRS cell phones) in theproximity are working. Upon verification of one or more of the abovevariables, the testing and monitoring program code 305 may re-executestep 402 in FIG. 4 to re-test the USB device 301 and SIM 311.

At step 403, the testing and monitoring program code 305 tests the USBdevice's wireless network connection. In one embodiment, this involveschecking the HLR 221 to determine whether there has been any recentwireless signaling from the USB device 301. There are three types ofwireless signaling which may be detected: a GSM authorization request; aMobile Switching Center (MSC) Location Update; and/or a Serving GPRSSupport Node (SGSN) Location Update. The presence of any of thesesignaling events indicates that the USB device 301 has successfullyregistered on the GSM (voice) network and/or the GPRS (data) network. Assuch, if any of these signaling events are detected, the testing andmonitoring program code 305 indicates that the USB device 301 has passedthe wireless network testing step 403 in FIG. 4.

If none of these signaling events are detected, then the testing andmonitoring program code 305 may initiate one or more troubleshootingoperations. For example, in one embodiment, the control center 280 maytransmit an SMS message to the USB device 301. If the SMS message issuccessful, then GSM service is available (but perhaps not the GPRSservice). In addition, the testing and monitoring program code 305 maycheck the GSM and GPRS registration using AT commands sent to thewireless modem 310 (e.g., to verify GSM registration, the “AT+CREG?”command should return “+CREG:x,1” or “+CREG:x,5”; where “x” is 0, 1 or2; to verify GPRS registration, the “AT+CGATT?” command should return“+CGATT:1” and “AT+CGREG?” should return “+CGREG:x,1” or “+CGREG:x,5”;where “x” is 0, 1 or 2). Finally, the testing and monitoring programcode 305 may perform a soft reset of the USB device 301 or the end usermay be prompted to perform a hard reset of the USB device 301.

During the test step 403, one or more aforementioned certificationscenarios may be tested at a subset 435 and the behavior of the USBdevice 301 is monitored by the testing and monitoring program code 305.For example, the network access mode of the SIM 311 may be changed to“GSM barred” and the behavior of the USB device 301 is monitored toestablish its signature behavior.

Returning to FIG. 4, at step 404, the testing and monitoring programcode 305 tests the IP/Internet connection of the USB device 301. In oneembodiment, this test includes two parts: (1) Check the GGSN todetermine whether the USB device 301 has initiated a Packet DataProtocol (PDP) session. PDP session context data will be present in theGGSN when the USB device 301 has established an active session.Consequently, the existence of a PDP session data indicates that thedevice was able to resolve the APN to a GGSN and start a PDP sessionwith that GGSN. (2) Run test traffic from the USB device 301 to acontrol center test server within the diagnostics system 270 and checkthe GGSN for real-time IP traffic statistics. This test fails if the USBdevice 301 has no upload/download bytes at all (which suggests a problemwith the USB device's IP capabilities) or if it has upload bytes but nodownload bytes (which suggests a problem reaching the test server).

Assuming that the above conditions are met, the testing and monitoringprogram code 305 confirms that the USB device 301 has passed theIP/Internet test step 404. If these conditions have not been met, thepossible reasons include: the APN is not configured properly; the USBdevice 301 is unable to open ports or sockets; the IP address isincorrect; and/or the IP data cannot flow bi-directionally.

During the test step 404, one or more aforementioned certificationscenarios may be tested at a subset 445 and the behavior of the USBdevice 301 is monitored by the testing and monitoring program code 305.For example, the testing and monitoring program code 305 may cause theUSB device to send traffic to a destination server whose IP address isblocked by the control center operator's firewall, and the behavior ofthe USB device 301 is monitored to establish its signature behavior.

In one embodiment, the testing and monitoring program code 305automatically performs the following troubleshooting operations and/orinstructs the user to manually perform these operations: check whetherthe USB device 301 has been configured with the correct APN; verify thatall sockets and ports on the USB device 301 are closed and free to use;and verify that the destination IP address programmed in the USB device301 is accurate.

In one embodiment, the results of all of the foregoing tests,certification and troubleshooting steps are stored within a diagnosticsdatabase 275. If necessary, the results may be reviewed by personnelwithin the control center 280 to provide guidance to the prospectivecustomer when troubleshooting new wireless applications. In oneembodiment, local environment statistics are transmitted to thediagnostics database 275 such as wireless signal strength of the trialdevice. The local environment statistics (and other test data) are thenusable for performing diagnostics for the trial device and/or aggregatedacross different trial devices to construct an estimate of theconditions in a given geographical area.

Moreover, in one embodiment, the testing and monitoring softwareautomatically checks for updates prior to executing the various testsand troubleshooting steps described above. The updates may includepatches and additional tests/troubleshooting operations. If an update isavailable, the testing and monitoring software automatically installsthe update (upon confirmation by the end user) and then executes thetests.

In one embodiment, the signature behavior of a mobile device obtained bythe above self-certification process can be stored in the mobile device100, in the control center database, and/or a network node. Thesignature behavior can be used to create a rules set defining thethresholds between the acceptable and aggressive behaviors of the mobiledevice 100. Based on the rules set, the aggressive behavior of themobile device can be detected, blocked, or throttled, in real time. Inone embodiment, a software agent is installed in the SIM 311. Thesoftware agent (also referred to as “agent” or SIM applet) may be a SIMapplet that controls the behavior of the mobile device 100, independentof the device modules and mobile applications. The control can beperformed without the mobile device 100 asking the customer to changethe application configuration or the control center 280 pushing newfirmware and/or software onto the mobile device 100. Via the softwareagent, an operator of the control center 280 is given control to (1)access the critical files in the SIM 311 which are required to operatethe modem, (2) disable (“nuke”) the mobile device 100 or the SIM 311 fora period of time called “quasi-dead” period and (3) enable/disable theservices provided to the SIM 311.

In one embodiment, the software agent or SIM applet may not have anydependency on SIM Application Toolkit (SAT) commands (commands between aSIM and a modem) or modem modules type/versions/release. In analternative embodiment, the software agent may utilize the SAT tointerface with the modem.

Before describing the software agent in further detail, it is helpful toexplain the basic file structure of the SIMs. A SIM contains both aprocessor (CPU) and an operating system. SIMs also have ElectricallyErasable Programmable Read Only Memory (EEPROM), Random Access Memory(RAM) for controlling program execution, and persistent Read Only Memory(ROM) which stores user authentication, data encryption algorithms, theoperating system, and other applications.

A SIM contains a hierarchical file system which resides in the EEPROM.The file structure consists of a Master File (MF), which is the root ofthe file system, Dedicated Files (DFs), and Elementary Files (EFs).Dedicated Files are subordinate directories under the MF. Subordinate toeach of the DFs are supporting EFs which contain the actual data. Whileall the files have headers, only the EFs contain data. The first byte ofthe header identifies the file type. Headers contain the security andmeta-information related to the structure and attributes of the file,such as length of record. The body of the EFs contains informationrelated to mobile applications. Files can be either administrative orapplication specific and access to stored data is controlled by theoperating system. A SIM card's MF, DFs, and EFs all contain securityattributes. One security attribute, the access conditions, areconstraints upon the execution of commands. These access conditionsfilter every execution attempt, thus ensuring that only those with theproper authorization can access the requested functionality controlledby the DFs or EFs. Access conditions can be thought of as somewhatanalogous to the user rights associated with the file/directoryattributes found in computer operating systems. According to oneembodiment of the invention, the control center 280 can sendover-the-air (OTA) instructions and content to change the SIM filecontents.

In the embodiment illustrated in FIG. 5, the SIM 311 includes aprocessor 540 and stores SIM files 530 in memory. The software agentdescribed above is shown in this embodiment as a SIM connection managermodule (SIM CMM) 550 residing in the SIM 311. The SIM CMM 550 is privyto all communication occurring between a modem module 510 and the SIM311. In one embodiment, the SIM CMM 550 uses or includes runningcounters and timers which are derived from a configurable rules set. TheSIM CMM 550 can intercept the communication between the modem module 510and the SIM 311, and block the communication if needed. The SIM CMM 550controls the access to the SIM files 530 (e.g., the EFs) in the SIM 311.According to one embodiment, the SIM CMM 550 can invalidate andrehabilitate any of the EFs based upon event counters or running timers.When an access condition for invalidating an EF is satisfied, the agent550 sets the respective flag in the file status accordingly. Aninvalidated file is no longer available to the mobile application 560(or modem module 510) for any function except for the select functionand the rehabilitate functions (unless the file status of the EFindicates that read and update are allowed). When an access conditionfor rehabilitating an invalidated EF is satisfied, the agent 550 setsthe respective flag in the file status accordingly.

In one embodiment, the control center 280 sends a rules set filecontaining one or more rules sets as over-the-air (OTA) messages to theSIM 311. The rules file can be stored in a Rules Set module 556 in theSIM 311. The rules file specifies, among other things, the number ofsuccessive accesses allowed for a particular SIM file, and the length ofthe disabling period (which may be indicated as a timer value or acounter value) when an aggressive behavior of the mobile device 100 isdetected. The SIM CMM 550 uses counters to count the number of accessesto the SIM files 530 (e.g., EF_(LOCI), EF_(IMSI), EF_(SST), etc.). Ifthe access to any of these files goes beyond a threshold, the SIM CMM550 will block the access temporarily or turn off features in theEF_(SST) that determine access to network service controlled via themodem module 510.

In one embodiment, the rules file includes a white sequence defining apattern of allowed device behavior, and/or a black sequence defining apattern of disallowed device behavior (including aggressive behaviors).In one embodiment, the rules file defines that upon detection ofaggressive behavior, the mobile device 100 is placed into a “quasi-dead”state by enabling pin 1 in an EF file or invalidating SIM files 530. TheSIM may be revived by the user, control center administrator, controlcenter automated processor, or network operator by entering a PIN orvalidating any of the invalidated SIM files 530.

When the modem module 510 powers up, the modem module 510 requestsaccess to the SIM 311 for various purposes. The modem module 510 may notaccess the SIM 311 until power cycled. However, if the SIM 311 has to bedisabled temporarily (e.g. due to detected aggressive behavior of themobile device 100), the SIM CMM 550 can perform one of the followingactions to prevent the modem module 510 from generating excessivetraffic on the wireless network: (1) Answer-to-Reset (ATR) response: theSIM CMM 550 can monitor the RESETs coming from the modem module 510 andignore the requests for a certain number of times. Ignoring the requestsgives a false sense to the modem module 510 that the SIM 311 is dead(i.e., non-functional). (2) Disable the modem module 510 via EF_(SST)(SIM Service Table): EF_(SST) is one of the SIM files 530. EF_(SST)indicates which services are allocated, and whether, if allocated, theservice is activated. If a service is not allocated or not activated inthe SIM 311, the service should not be selected. The SIM CMM 550 canenable/disable the modem module 510 by validating/invalidating theentire EF_(SST) or validate/invalidate any of the services toallow/block access to the wireless network. (3) Block access toEF_(IMSI): EF_(IMSI) is one of the SIM files 530. EF_(IMSI) contains theIMSI. If the modem module 510 cannot read the IMSI in EF_(IMSI), it willnot try to register on the wireless network and result in an “InvalidSIM” response.

In an alternative embodiment, the SIM CMM 550 is embedded softwarewithin the SIM 311 that controls the modem module 510, ensures that aconnection is established and maintained, enables externalnetwork-initiated connections, and provides remote control options anddiagnostic functions (e.g. via the control center 280). The SIM CMM 550includes platform-independent software/code and platform adaptationcomponents. In the embodiment of FIG. 5, the SIM CMM 550 includes anApplication Programming Interface (API) module 552, a Rules EngineModule 554, and a Rules Set Module 556.

The API module 552 provides an interface to a mobile application 560that allows M2M or mobile application developers to rapidly develop anddeploy mobile applications without detailed knowledge of wirelessnetworking or AT commands. Ultimately, this results in a faster time tomarket and a robust wireless solution.

The SIM CMM 550 platform-independent software/code manages allcommunications utilizing the Rules Engine Module 154 which comprises ageneric configurable state machine. The SIM CMM 550 also utilizes theRules Set Module 556, which comprises rules sets that provide connectionlogic that defines operation of the modem module 510. The rules sets maybe created, revised, updated, and tested and can be distributed remotelyby various means, including generation and distribution by the controlcenter 280. In one embodiment, the rules sets are created, at least inpart, based on results of the certification process described above.

The Rules Engine Module 554 including the configurable state machine maybe configured by rules set files that direct the modem module 510 insetting up and maintaining connections. Rules sets may be maintained anddistributed from the control center 280. The control center 280 maycreate rules sets specific to each of the major wireless modules. Rulessets may also be obtained from alternative sources other than thecontrol center 280. A collection of rules in the rule set drives thestate transitions either unconditionally or in response to events.Events are raised based on modem module 510 responses, connectivitychanges, and the action of various timers and counters defined in therules sets. Outputs specified on state transitions result in AT commandsto drive the behavior of the modem module 510.

The state machine is defined by the rules sets, which specify the statetransition rules, and the actions to be taken in the event of radionetwork errors. If desired, there can be different rules sets fordifferent types of applications (e.g. stationary vs. mobile device,roaming vs. non-roaming device, etc.).

FIG. 6 illustrates a flow diagram for an implementation of a rules setaccording to an embodiment of the invention. The rules set containscommunications logic/flow including back-off logic. The rules setestablishes network connections, interprets responses from themodule/modem or network, eliminates aggressive wireless device behavior,and may be module/modem specific.

In step 600, the mobile device 100 is powered up. In step 602, a modem510 attempts a GSM registration. In step 604, after the mobile device isGSM registered the device is GSM idle. In step 606, the modem 510receives a connect request for establishing a data connection andattempts a “dial” operation (establish a PDP context). In step 608, ifthe data connection is established the mobile device 100 is “connected”.If the data connection is not established i.e. a “failure”, in step 610the SIM CMM 550 issues an AT command to the modem 510 requesting the“extended release” or “error code” (JEER0, JEER1, JEER2, JEER3, JEER4,etc.).

Depending on the type of “error code” returned by the modem 510, the SIMCMM 550 utilizes the Rules Engine Module 554 including the configurablestate machine to determine the proper course of action. For example, ifthe error code is JEER 4, the SIM CMM 550 issues an AT command to themodem 510 to retry step 602 for GSM registration. If the error code isJEER 2, the SIM CMM 550 issues an AT command to the modem 510 to “hold”in step 614 for a length of time defined by a back-off timer beforeresetting the modem 510 in step 600. If the error code is JEER 0, theSIM CMM 550 issues an AT command to the modem 510 to try to establish aconnection with a different operator in step 616 by starting over with aGSM registration in step 602. If the error code is JEER 1, the SIM CMM550 issues an AT command to the modem 510 to “hold” or “service wait” instep 618 for a length of time defined by a back-off timer and instructsthe modem 510 to remain in GSM idle in step 604 before re-trying toestablish a data connection in step 606. If the error code is JEER 3,the SIM CMM 550 issues an AT command to the modem 510 to enter a “dead”state in step 612.

As shown in FIG. 6, the rules set comprises a collection of states,rules, timers and counters. The rules set is described by a binary filewith a proprietary format. Rules sets may be very flexible and candefine a wide range of logic to control the operation of the modem.There may be different strategies for managing the connectivity of amodem. For instance, one strategy might be to obtain a connectionregardless of how long it takes. Another might be to obtain a connectionas quickly as possible. Rules sets allow wide variation in the systemlogic to accommodate a large range of strategies.

States define arbitrary states in the Rules Engine Module 554 that mayrepresent system states. Each state is defined by a name that isreferenced by rules. Events are created by modem responses or expirationof timers and counters. Modem responses can be either normal or errorresponses to AT commands.

Timers are started on events and expire after their timeout value,creating timeout events. Timers can be defined to operate with a“back-off” mechanism, wherein the timeout period may increase after eachexpiration. The utilization of timers may prevent aggressive behaviorsof the system where operations are retried frequently, causingunnecessary network traffic. Another feature of the timers israndomization, where part of the timeout value can be a random value.The utilization of randomization may prevent a large number of devicesfrom attempting operations on the network at the same time. In oneembodiment, a formula for calculating the next expiration value, T2,from the current value, T1 is: T2=C+n*T1, where C is a constant and n isa multiplier. If n is a positive value, the current timeout value ismultiplied by n and added to C. If n is a negative number, a randomvalue between 0 and the absolute value of n is calculated. Counterscount events that occur in the system to allow the rules set logic totake action after a fixed number of events.

Rules define the transition from one state to another. They aretriggered by events and create outputs on the transitions. These outputscan be modem commands, or starting or cancelling timers or counters. Asthe logic transitions from state to state within the rules set, theoutputs' drive the modem to perform the actions that affect modemconnectivity.

The SIM CMM 550 and the rules set are flexible in terms of how theyhandle the different radio network error and reject codes. For example,an event handled by the rules set may be a situation where the mobiledevice 100, while involved in or attempting a data session, receives apacket data protocol (PDP) reject cause code 33 from a network and themodem and/or SIM CMM 550 continues to receive PDP activation requestsfrom the upper device application layer. The SIM CMM 550 can back-offand retry on the same carrier, back-off then reset the modem module 510,attempt to connect on another carrier or stop attempting.

In another example, if the mobile device 100 receives a GPRS attachreject with cause code 17, the SIM CMM 550 (in accordance to the rulesset) will instruct the modem module 510 to attempt to connect on anothercarrier (e.g. a roaming partner).

In one embodiment, the SIM CMM 550 can issue an AT command (e.g.,“CEER”) to the modem module 510 to request for the extended releasecause. The modem module 510 in return replies with an error code; e.g.,JEER0, JEER1, JEER2, JEER3 or JEER4. Each error code indicates adistinct type of error that allows the SIM CMM 550 or the control center280 to determine the cause of connection problems.

The control center 280 has the ability to “push” rules set files tomobile devices on the network. The control center 280 may initiate thisfunction by sending an SMS message to the mobile app, modem, or SIM CMM550. Upon receiving the message, the SIM CMM 550 establishes an IPconnection via the wireless data network, retrieves the specified rulesset, and disconnects. The SIM CMM 550 may utilize a command channel forsuch communication. The SIM CMM 550 may then restart or reboot using thenew rules set. If the SIM CMM 550 encounters any errors in loading thenew rules set, the SIM CMM 550 may revert to the last known good rulesset.

The SIM CMM 550 interfaces with the mobile application 560 by utilizingthe API 552. In one embodiment, a call back function is embedded in themobile application 560 source code. This function can be called by theSIM CMM 550 whenever information is available. All data is deliveredasynchronously using this mechanism. Network initiated connectionrequests are also communicated using the call back function. The mobileapplication 560 source code must complete the connection operations bycalling the SIM CMM 550 in response to these requests. The SIM CMM 550can be initialized by calling CMM Open ( ). After the initialization,the API 552 is utilized to connect, disconnect, request information, orsend SMS messages. Calling CMM Close ( ) releases the resources used bythe API 552.

The API 552 is a platform-independent interface consisting of methodsfor connecting, disconnecting, querying parameters, and sending SMSmessages. The API 552 allows a developer to design and implement amobile application utilizing existing operating systems such as WindowsCE, VxWorks, MeeGo, and QNX, etc. In one embodiment, the mobileapplications 560 written in C or C++ can utilize the API 552 directly.In another embodiment, a wrapper may be created for the mobileapplications 560 written in other program language in order to utilizethe API 552. The API 552 sends information to the mobile application 560through an asynchronous notification mechanism. The API 552 may send theinformation synchronously as well. The mobile application 560 registersa call back function and the SIM CMM 550 calls this function any timethere is information to communicate. This mechanism is used to deliverstatus messages from the SIM CMM 550, connection status information, andmobile terminated SMS messages.

The SIM CMM 550 drives the modem module 510 using all necessary ATcommands and responses. In addition, the SIM CMM 550 provides andexecutes logic to handle the various modem module 510 and network errorsituations in ways that are compatible with the wireless network. TheSIM CMM 550 ensures that the mobile device 100 connects to the wirelessnetwork when necessary and stays connected. The SIM CMM 550 managesintelligent re-tries when there are network related problems, selectingalternative networks when needed. The SIM CMM 550 may also enablealternative network selection in regards to international roaming whichmay be inherently less reliable than a native service. In particular,there is the so-called “stuck SIM” problem, an inherent weakness of GSMthat can allow a mobile device to remain on a network that can provideGSM service, but is temporarily unable to provide GPRS service. In thissituation, the SIM CMM 550 may ensure that an alternative network isselected and significantly improve the reliability of internationalroaming.

The SIM CMM 550 also provides a valuable diagnostic function. The SIMCMM 550 monitors the quality of wireless communications and makes theinformation available on demand for diagnostics purposes. The SIM CMM550 remotely monitors performance of network data connections, checksfor errors, and checks the signal strength at the device.

The SIM CMM 550 provides the ability to remotely cause the mobile device100 to connect or disconnect. The control center 280 may also be used toinitiate a connect or disconnect by sending SMS messages to the SIM CMM550. The SIM CMM 550 may use the call back mechanism to notify themobile application 560 of the request, and the mobile application 560may complete the request by making API 552 calls to CMM Connect or CMMDisconnect.

The SIM CMM 550 maintains log files that record the activity of the SIMCMM 550. These log files may be uploaded and viewed in the controlcenter 280. The control center 280 may initiate the request to uploadthe logs by sending an SMS message to the SIM CMM 550. Upon receivingthe SMS message, the SIM CMM 550 may establish an IP connection via thewireless data network, upload the log files to the control center 280and then disconnect.

In the illustrated embodiment, the service provider may be AT&T and themodem modules 510 include those wireless modules supported on the AT&Tdata network. For example, modem modules 510 may include a CinterionMC55i, a Telit GE-865, a Siena Q2426, etc. However, the underlyingprinciples of the invention are not limited to any particular serviceprovider.

The above description relates to a SIM-based solution to aggressivebehaviors. In an alternative embodiment, detecting and real-timeblocking of aggressive behaviors can be performed by a network node;e.g., at an SS7 STP gateway. In this alternative embodiment, a softwareagent, such as the SIM CMM 550 described above, can be implemented in anetwork node; e.g., an STP. An example of an STP gateway is shown inFIG. 1B as STP 3471 and STP 3472. In one embodiment, this approach isbased upon the assumption that the signature behavior of the mobiledevice is known from the self-certification process described above. Thecustomer may agree that the signature behavior defines the acceptablebehavior under the various scenarios that have been tested in theself-certification process. If the signature behavior of the mobiledevice is not known, a default signature behavior is applied to thatdevice.

Alternatively, any other process may be used that characterizes andquantifies the aggressive behavior of a mobile device and creates adevice signature.

Referring to the network architecture 700 of FIG. 7, a Signal TransferPoint (STP) 720 is a router that relays SS7 messages between signalingend-points (SEPs) and other signaling transfer points (STPs) 720.Typical SEPs include service switching points (SSPs) 710 and servicecontrol points (SCPs) 730. The STP 720 is connected to adjacent SEPs andadjacent STPs via signaling links. Based on the address fields of theSS7 messages, the STP 720 routes the messages to the appropriateoutgoing signaling link. SEPs send signaling messages to other SEPs, butthe messages are normally routed via the SEP's adjacent STPs. An STP'smain function is to identify the best path for two SEPs to communicate.

In one embodiment, the STP 720 performs real-time detection against thedevice signature by leveraging a sliding window concept, which uses pastbehavior and expected behavior of the mobile device as a criterion fordetection. When the detected behavior deviates from the signaturebehavior by a predetermined amount, the STP 720 blocks or throttlestraffic from and to the Global Title (GT) per mobile device. A GT is aunique address used in Signaling Connection Control Part (SCCP) protocolfor routing messages in telecommunication networks. A GT is equivalentto an IP address in the SS7 communication.

In one embodiment, the STP 720 includes a software agent 725, whichincludes a Rules Engine module and a Rules Set module performing thesame functions as the Rules Engine module 554 and the Rules Set module556 of FIG. 5. The Rule Set module in the STP 720 may define the same orsimilar states and state transitions per mobile device as shown in FIG.6. In an alternative embodiment, the detection of the aggressivebehavior may be performed by the mobile devices and/or control center280. When an aggressive behavior of a mobile device is detected, the STP720 is notified to block or throttle traffic to and from that mobiledevice.

In yet another embodiment, the aggressive behavior of a mobile devicecan be detected and managed by a control center platform (e.g., thecontrol center 280 of FIG. 1B and FIG. 2). The control center platform180, 280 uses the following data sources: HLR SS7 logs, Radiusauthentication logs, Radius accounting records, GGSN CDRs, SMSC SMSlogs, and the SIM Status.

The HLR SS7 logs are sent from HLRs to control center in near real time.The HLR SS7 logs are stored in a control center Vault server, a databasethat tracks the historical statistics on each IMSI. The HLR SS7 logsprovides MSC/SGSN Locations (Location Updates and Cancel Locations) foreach IMSI, including the carrier that it has registered with and TripletRequests i.e., GSM authentication requests for each IMSI.

The Radius authentication logs are sent from Radius servers to controlcenter in near real time. The Radius authentication logs are stored in acontrol center Authentication Database. The Radius authentication logsprovide GPRS authentication successes and failures for each IMSI.

The Radius accounting records are sent from Radius servers to controlcenter in near real time. The Radius accounting records are stored in acontrol center Usage Database. The Radius accounting records provideGPRS session information, including In-Session Status, Device IPaddress, SGSN address, duration, up/down bytes.

The GGSN CDRs are sent from GGSN to control center in near real time.The GGSN CDRs are stored in the control center Usage Database. The GGSNCDRs provide the data usage, including partial records with theincremental data usage in the middle of a session.

The SMSC SMS logs are sent from SMSC to control center in near realtime. The SMSC SMS logs are stored in the control center Usage Database.The SMSC SMS logs provide SMS statistics, including the number, size,frequency, and delivery status per IMSI.

The SIM Status is tracked by the control center. The SIM Status isstored in the control center Provisioning Database. The SIM Statusprovides the SIM activation status, suspend status, overage limitstatus.

These data sources are also used by other parts of the control centerplatform. For example, a Network Guard function uses the Radiusauthentication logs to identify abusive SIMs (currently defined as theIMSIs that had more than 60 GPRS authentication failures per hour) andautomatically blocks them from the network.

The aggressive behaviors may be present when (1) the mobile deviceperforms >100 SAI (Send Authentication Information) operations in a24-hour period to HLR front end servers, and/or (2) the mobile devicegenerates >50 Packet Data G-CDR (GGSN Call Data Records) in a 24-hourperiod.

With respect to the SAI operations, a control center database (vault)server monitors and tracks the numbers in the log files from all of theHLR servers to which the control center has access. These HLR log filescontain 24/7 running records for each unique IMSI (subscriber) for thefollowing HLR Map protocol operations: SAI, LU (Location Update), CL(Cancel Location) and the like. Therefore, if the daily agreed maximumnumber of authentication requests (i.e., SAI messages) towards any HLRis exceeded for a subscriber IMSI, the subscriber's IMSI will be flaggedautomatically and reported to the control center administrator. The datain the report contains the following: IMSI, ICCID, number ofauthentication requests, and SIM State (e.g., activated/purged/testready, etc.). The account name can be gleaned by the account number andoperator name. This data is made available for the administrator oroperator to target and perform an action on either each ICCID (whichidentifies a subscriber), or for all offending IMSIs/ICCIDs by theaccount name. Alternatively, a control center processor or a rulesengine (such as CSP engine 125 shown in FIG. 1A) may automaticallyimplement a rule set based automated process to perform an action oneither each ICCID (which identifies a subscriber), or for all offendingIMSIs/ICCIDs by the account name.

The actions include, but are not limited to the following: (1) purge thesubscriber profile in the HLR (subscriber deleted from HLR) via acontrol center API call to the HLR. (2) Change the subscriber profile tosubscribe to “GSM only not GPRS” (i.e., Network Access Mode) via acontrol center API call to the HLR. (3) Change the subscriber profile tobe network registration barred, which disallows location update via acontrol center API call to the HLR. (4) Amend the subscriber profilerestriction to block certain MNC/MCC combinations to disallow roamingvia a control center API call to the HLR. (5) Force the subscriber toenter a PIN to enable the SIM when the next location update attemptoccurs by an over-the-air update via SMS, thus rendering the SIM uselessuntil a correct PIN is manually entered via a control center API call.

With respect to the Packet Data G-CDR, the control center database(vault) server monitors and tracks the number of G-CDRs from all of theGGSNs to which the control center has access. The GGSN log files thatare sent to the control center contain 24/7 running records for eachunique IMSI/ICCID. Therefore, if the daily agreed maximum quantity ofG-CDR generation is exceeded for a subscriber IMSI, the subscriber'sIMSI/ICCID will be flagged and automatically reported to the controlcenter administrator. The data in the report contains the following:IMSI, ICCID, quantity of G-CDRs, and SIM state (e.g.,activated/purged/test ready, etc.). The account name can be gleaned bythe account number and operator name. This data is made available forthe administrator or operator to target and perform an action on eithereach IMSIs/ICCID (which identifies a subscriber), or for all offendingIMSIs/ICCIDs by the account name. Alternatively, a control centerprocessor or a rules engine may automatically implement a rule set basedautomated process to perform an action on either each ICCID (whichidentifies a subscriber), or for all offending IMSIs/ICCIDs by theaccount name. The actions include the five actions described above inconnection with the SAI operations.

In one embodiment, a thumb rule can be provided to the control centerprocessor or a rules engine and/or operators for any kind of network orconnection failure at any stage of connection establishment. Forexample, it is acceptable for a mobile application to retry in case ofconnection or connectivity failure. However, the thumb rule may specifythe following: the initial retries may be attempted no more frequentlythan once every minute, and no more than 4 times in succession;additional retries may occur at 15 minutes, 30 minutes, then every 60minutes; i.e. at 1(initial attempt), 2, 3, 4, 5, 15, 30, 60, 120, 180minutes, etc.; and a mobile device cannot have more than four resets insequence in 24 hours.

The field behaviors of mobile devices vary from one type/category ofdevices to another type/category of devices. For example, an M2M devicecategory has a different behavior in field use from an emerging devicecategory. Thus, the thumb rule is adapted to different categories ofmobile devices.

FIG. 8 is a flow diagram illustrating a method for detecting andblocking the aggressive behavior of a mobile device according to oneembodiment of the invention. The method may be performed by the mobiledevice (e.g., the mobile device 100 of FIG. 5). In one embodiment, themethod may be performed by the SIM CMM 550 of FIG. 5. In alternativeembodiments, the method may be implemented using different combinationsof software, firmware, and/or hardware.

At step 801, the mobile device receives over-the-air instructions via awireless network from a control center to create or modify a rules setin the SIM, where the rules set defines an acceptable behavior of themobile device. At step 802, the mobile device (more specifically, theSIM) monitors requests from a wireless modem within the mobile devicefor access files stored in the SIM. At step 803, an aggressive behaviorof the mobile device is detected based on the rules set. At step 804,the wireless modem is blocked from generating traffic in the wirelessnetwork.

The operations of the methods of FIGS. 4 and 8 have been described withreference to the exemplary embodiment of FIG. 5. However, it should beunderstood that the operations of the methods of FIGS. 4 and 8 can beperformed by embodiments of the invention other than those discussedwith reference to FIG. 5, and the embodiment discussed with reference toFIG. 5 can perform operations different from those discussed withreference to the methods of FIGS. 4 and 8. While the methods of FIGS. 4and 8 show a particular order of operations performed by certainembodiments of the invention, it should be understood that such order isexemplary (e.g., alternative embodiments may perform the operations in adifferent order, combine certain operations, overlap certain operations,etc.).

FIG. 9 is a high level flow diagram illustrating the operation of a SIMapplet running or operating on a mobile device. At step 900 the mobiledevice is powered on. At 902 the mobile device modem boots up. At 904the SIM powers up and a processor can access SIM files includingEFgprsloci, EFloci, EFimsi, etc. At 906 the SIM applet/agent utilizing arules set monitors communications between the modem and the SIM. Duringnormal operation, the modem is accessing SIM files on a regular basis.An expected amount of access, or a threshold level, for each SIM file ispredetermined for normal operation. At 908 the SIM agent determines ifthe mobile device is acting aggressively. The SIM agent is determiningwhether the modem is accessing certain SIM files beyond some expectedlevel of operation, i.e. a predetermined threshold. At 910 the SIM agentmay access the rules set for further information. If the SIM agentdetermines the mobile device is aggressive the SIM agent will disablethe corresponding SIM file to prevent or throttle the aggressivebehavior.

FIG. 10 is a flow diagram illustrating an embodiment of the operation ofa SIM applet running on a mobile device. Aggressive behavior generallymanifests itself in an abnormal amount of reset commands issued by themobile application or OS. Typically M2M device developers employ logicthat simply resets the modem in response to connectivity issues. Forillustrative purposes, the logic of FIG. 10 is based on the modemattempting to access multiple SIM files (EFxxx) in response to an answerto reset (ATR) command issued by the mobile application or operatingsystem.

In one embodiment, if the SIM applet determines that the mobileapplication or OS is acting aggressively, i.e., excessive resetting, theSIM applet may block access to SIM files. Thereafter, the SIM applet mayemploy a back-off counter and threshold mechanism that counts the numberof ATR attempts while continuing to block access to SIM files until thecount exceeds a threshold value, for example 20 counts. After 20 counts,any network related connectivity issue may have been resolved (networkrelated connectivity issue is fixed) and the ATR can now then beallowed.

At step 1000 the modem requests access to multiple SIM files EFxxx. TheSIM applet is constantly monitoring the pattern of accesses of SIM filesby the modem. For example, the modem may access the EFimsi file every 30seconds. The SIM applet would recognize abnormal or aggressive behaviorif the modem attempts to access the EFimsi file beyond this expectedpattern of operation.

At 1002 the SIM agent determines if the SIM is operational oraccessible. If access to any of the SIM files has been previouslyblocked the SIM agent will determine that the SIM is not operational oraccessible and in step 1004 the SIM agent will update a counter when theSIM access is denied, for example, previously determined aggressive ATRoperations. For illustrative purposes, step 1004 may repeated severaltimes when a back-off counter is employed in the case of previouslydetermined aggressive ATRs. After a threshold count is exceeded for theback-off counter the SIM may now be flagged operational or accessible(step 1002).

If the SIM agent determines that the SIM is operational or accessiblethen the access to the SIM files proceeds and in step 1006 the SIM agentfilters the specific access event and stores the event/accessinformation in step 1008 in a static storage for all the events andstates. In step 1010, if the access to multiple SIM files is in responseto an ATR then a counter for the ATR is updated in step 1012. Exceedinga threshold count (or count/time period) for ATRs may trigger the SIMagent to determine aggressive behavior is present and that the SIMshould now be flagged non-operational or not accessible (step 1002),then the next access to the SIM files should not proceed to step 1006but diverts to step 1004 to implement the back-off counter.

Alternatively, in step 1014 if the access is to an EFloci file then acounter for the EFloci file is updated in step 1016. In step 1018, ifthe access is to an EFimsi file then a counter for the EFimsi file isupdated in step 1020. In step 1022, if the access is to an EFsst filethen a counter for the EFsst file is updated in step 1024. In step 1026,if the access is to an EFsms file then a counter for the EFsms file isupdated in step 1028. The process is then repeated for access to any ofthe other EFxxx files.

The operations of the methods of FIGS. 9 and 10 have been described withreference to the exemplary embodiment of FIG. 5. However, it should beunderstood that the operations of the methods of FIGS. 9 and 10 can beperformed by embodiments of the invention other than those discussedwith reference to FIG. 5, and the embodiment discussed with reference toFIG. 5 can perform operations different from those discussed withreference to the methods of FIGS. 9 and 10. While the methods of FIGS. 9and 10 show a particular order of operations performed by certainembodiments of the invention, it should be understood that such order isexemplary (e.g., alternative embodiments may perform the operations in adifferent order, combine certain operations, overlap certain operations,etc.).

This CIP application is based upon and claims the benefit of priorityfor prior U.S. patent application Ser. No. 12/387,962, now U.S. Pat. No.8,391,161 filed on Mar. 7, 2009 the entire contents of which areincorporated herein by reference. U.S. Pat. No. 8,391,161 discloses anetwork status display system. In one embodiment, the network statusdisplay system comprises a processor 1406 further comprising diagnosticdevice software 1408 (see FIG. 14). In one embodiment, the networkstatus display system may be a control center platform 180, 280comprising hosted service platform 120 and CSP engines 125 (see FIGS.1A, 1B) wherein processor 1406 and CSP engines 125 are equivalent.

The control center platform 180, 280 uses the following data sources:HLR SS7 logs, Radius authentication logs, Radius accounting records,GGSN CDRs, SMSC SMS logs, and the SIM Status.

The HLR SS7 logs are sent from HLRs to control center in near real time.The HLR SS7 logs are stored in a control center Vault server, a databasethat tracks the historical statistics on each IMSI. The HLR SS7 logsprovides MSC/SGSN Locations (Location Updates and Cancel Locations) foreach IMSI, including the carrier that it has registered with and TripletRequests i.e., GSM authentication requests for each IMSI.

The Radius authentication logs are sent from Radius servers to controlcenter in near real time. The Radius authentication logs are stored in acontrol center Authentication Database. The Radius authentication logsprovide GPRS authentication successes and failures for each IMSI.

The Radius accounting records are sent from Radius servers to controlcenter in near real time. The Radius accounting records are stored in acontrol center Usage Database. The Radius accounting records provideGPRS session information, including In-Session Status, Device IPaddress, SGSN address, duration, up/down bytes.

The GGSN CDRs are sent from GGSN to control center in near real time.The GGSN CDRs are stored in the control center Usage Database. The GGSNCDRs provide the data usage, including partial records with theincremental data usage in the middle of a session.

The SMSC SMS logs are sent from SMSC to control center in near realtime. The SMSC SMS logs are stored in the control center Usage Database.The SMSC SMS logs provide SMS statistics, including the number, size,frequency, and delivery status per IMSI.

The SIM Status is tracked by the control center. The SIM Status isstored in the control center Provisioning Database. The SIM Statusprovides the SIM activation status, suspend status, overage limitstatus.

These data sources are also used by other parts of the control centerplatform. For example, a Network Guard function uses the Radiusauthentication logs to identify abusive SIMs (currently defined as theIMSIs that had more than 60 GPRS authentication failures per hour) andautomatically blocks them from the network.

The network status display system comprises a display for correlatingmany types of historic events for a cellular device on a cellularnetwork along a common timeline. Data is retrieved from a cellulardevice and from the systems that control the cellular network and isdisplayed in such a way so as to enable the user to identify problems,unusual behaviors, or inconsistencies. Controls on the network statusdisplay system additionally allow communication with the cellular devicein order to gain (e.g., probe the system by actively controllingsystems) further diagnostic information.

FIG. 11 is a block diagram illustrating an embodiment of a wirelesscellular network with data network overlay. In the example shown,cellular device 100 comprises a communications device that uses wirelesscellular network 1101 and wireless data network 1103. In someembodiments, wireless cellular network 1101 comprises a global systemfor mobile communications (GSM) network and wireless data network 1103comprises a general packet radio service (GPRS) network. In someembodiments, cellular network 1101 and data network 1103 comprise acellular network and a data network other than a GSM network and a GPRSnetwork. In various embodiments, cellular device 100 comprises acellular telephone, a mobile smart phone with data transfer capability,a mobile data communications device, a network interface for a wirelessdata processing device, or any other appropriate mobile communicationsdevice. Wireless cellular network 1101 allows a user of cellular device100 to engage in voice communications with devices accessed throughexternal voice network 1108 and data communications with devicesaccessed through external data network 1112. Cellular device 100communicates with wireless cellular network 1101 via cellular basestation 1102. Base station 1102 contains a radio transmitter andreceiver for communicating with cellular devices (e.g., cellular device100) and a communications system for communicating with base stationcontroller 1104. Base station controller 1104 controls base station 1102and enables communication with external voice network 1108 via networkswitching subsystem 1106 and with external data network 1112 via coredata network 1110. In various embodiments, base station controllercontrols one base station, two base stations, ten base stations, or anyother appropriate number of base stations.

Network switching subsystem 1106 controls voice network switching,maintains a register of cellular device locations, and connects the GSMnetwork with external voice network 1108. External voice network 1108 isa voice telephony network for connecting various voice telephonydevices. In various embodiments, external voice network 1108 comprises apublic switched telephone network, a private voice telephony network, orany other appropriate voice telephony network. By enabling cellulardevice 100 to connect to external voice network 108, a user of cellulardevice 100 is able to have a verbal conversation with another user of adevice that is directly or indirectly connected to external voicenetwork 1108 (e.g., a cell phone user, a wired telephone user, aninternet telephone user—for example, a voice over internet protocoluser). For example, a user can use cellular device 100 to make atelephone call to someone. Core data network 1110 controls datacommunications switching and connects cellular network 1101 withexternal data network 1112. External data network 1112 comprises a datacommunications network for connection various data communicationsdevices. External data network 1112 comprises one or more of thefollowing: a local area network, a wide area network, a wired network, awireless network, the Internet, a fiber network, a storage area network,or any other appropriate network enabling communication. By enablingcellular device 100 to connect to external data network 1112, a user ofcellular device 100 or cellular device 100 itself can interact withother devices or servers or applications running on other devices orservers via external data network 1112. For example, cellular device 100can contact a server to inquire about a transaction (e.g., a credit cardauthorization for a purchase).

Cellular diagnostic device 1114 comprises a cellular device configuredfor diagnostic operations on a wireless network. Cellular diagnosticdevice 1114 communicates with wireless cellular network 1101 via basestation 1116. In some embodiments, base station 1116 is the same basestation as base station 1102. Base station controller 1118 controls basestation 1116 and enables communication with external voice network 1108via network switching subsystem 1106 and with external data network 1112via core data network 1110. In some embodiments, base station controller1118 is the same base station controller as base station controller1104. Cellular diagnostic device 1114 is able to run diagnosticoperations on a cellular device (e.g., cellular device 100)communicating with wireless cellular network 1101, and to displaydiagnostic information. In various embodiments, cellular diagnosticdevice 1114 comprises a cellular telephone, a mobile smart phone withdata transfer capability, a mobile data communications device, a networkinterface for a wireless data processing device, or any otherappropriate mobile communications device.

Diagnostic device 1120 communicates with wireless cellular network 1101via external data network 1112 and core data network 1110. Diagnosticdevice 1120 is able to run diagnostic operations on a cellular device(e.g., cellular device 100) communicating with wireless cellular network1101, and to display diagnostic information. In various embodiments,diagnostic device 1120 comprises a computer, a network enabled datadevice, a network appliance, or any other appropriate network enableddevice.

FIG. 12 is a block diagram illustrating an embodiment of a networkswitching subsystem. In some embodiments, network switching subsystem1200 implements network switching subsystem 1106 of FIG. 11. In theexample shown, network switching subsystem 1200 comprises mobileswitching center 1202, signaling system seven network 1204, visitorlocation register 1206, and home location register 1208. Mobileswitching center 1202 controls (e.g., maintains the connection as acellular device moves between base stations), sets up (e.g., accesses anexternal network to create a connection) and releases (e.g., accesses anexternal network to destroy a connection) a voice connection between acellular device (e.g., cellular device 100 of FIG. 11) and another voicecommunication device (e.g., a voice communication device accessedthrough external voice network 1108 of FIG. 11). In some embodiments,mobile switching center 1202 additionally tracks the time of the voiceconnection for the purpose of charging cellular device 100. Visitorlocation register 1204 communicates with mobile switching center 1202.In some embodiments, visitor location register 1204 is integrated as apart of mobile switching center 1202. Visitor location register 1204maintains a list of cellular devices that have roamed into the areaserved by mobile switching center 1202 along with a set of attributesdescribing each cellular device. In the event that a connection needs tobe made to a cellular device while it is roaming in the network servedby mobile switching center 1202 (e.g., the cellular device receives aphone call) the device attributes (e.g., type of device, current devicelocation, device account type) are retrieved from visitor locationregister 1204 in order to properly make the connection. Home locationregister 1208 maintains a list of cellular devices whose home network isthat of network switching system 1200. In various embodiments, acellular device home network comprises the network served by a singlebase station (e.g., base station 1102 of FIG. 11), the network served bya single base station controller (e.g., base station controller 1104 ofFIG. 11), the network served by a plurality of base station controllers,the entire network of a cellular carrier, or any other appropriatenetwork. When a device leaves its home network, the visitor locationregister for the network the device has roamed to communicates with thehome location register in the home network for the device via signalingsystem seven network 1206. When home location register 1208 of the homenetwork of the cellular device has confirmed to visitor locationregister 1204 of the network the device has roamed to that it can allowthe device to use its network (e.g., the network associated with homelocation register 1208), the device is added to visitor locationregister 1204, and mobile switching center 1202 sets up thecommunication.

In some embodiments, GPRS core network 1250 implements GPRS core network1110 of FIG. 11. In the example shown, GPRS core network 1205 comprisesserving GPRS support node (SGSN) 1252, gateway GPRS support node (GGSN)1254, and charging gateway function 1256. SGSN 1252 sends data packetsto and receives data packets from a cellular device (e.g., cellulardevice 100 of FIG. 11) and communicates data with GGSN 1254. SGSN 1252also retrieves information about roaming devices by contacting homelocation register 1208 of the home network of the roaming device, viasignaling system seven network 1206. GGSN 1254 serves as an interfacebetween GPRS core network 1250 and an external data network (e.g.,external data network 1112 of FIG. 1). GGSN 1254 communicates with SGSN1252 and with the external data network, and translates the data packetsinto the appropriate formats for the devices on each side. In someembodiments, there is more than one GGSN in a given GPRS core network,each GGSN connecting to the same SGSN. In some embodiments, each GGSNconnects to the same external data network. In some embodiments, aplurality of GGSNs connect to one or more different data networks.Charging gateway function 1256 communicates with SGSN 1252 and GGSN 1254and tracks the total amount to charge each cellular device connected toGPRS core network 1250. A charging session by a charging gatewayfunction is known as a charging data record (CDR). In some embodiments,a single data session can be charged as a plurality of sequential CDRs.

FIG. 13 is a block diagram illustrating an embodiment of a cellulardevice 1300. In some embodiments, cellular device 1300 comprisescellular device 100 of FIG. 11 and mobile device 100 of FIGS. 1A and 1Band FIG. 5. In some embodiments, cellular device 1300 comprises the SIM311 further comprising the SIM files 530 and SIM connection managermodule 550 shown in mobile device 100 of FIG. 5. In one embodiment, allof the previous description and discussion of the functionality of themobile device 100 applies to the cellular device 1300.

In the example shown, cellular device 1300 comprises radio transmitter1302, radio receiver 1304, processor 1306, memory 1310, subscriberidentity module 1312, and display 1314. Radio transmitter 1302 and radioreceiver 1304 communicate with a base station (e.g., base station 1102of FIG. 11) using wireless radio communication. For example, radiotransmitter 1302 and radio receiver 1304 communicate according to theGSM standard. In various embodiments, radio transmitter 1302 and/orradio receiver 1304 communicate using frequency modulated signals, phasemodulated signals, amplitude modulated signals, time divisionmultiplexing signals, code division multiplexing signals, or signalsencoded using any other appropriate communication scheme or protocol. Invarious embodiments, radio transmitter 1302 and/or radio receiver 1304communicate in the medium frequency band, the high frequency band, thevery high frequency band, the ultra-high frequency band, or any otherappropriate frequency band. In various embodiments, radio transmitter1302 and/or radio receiver 1304 communicate voice signals, data signals,text signals (e.g., short message service (SMS)), configuration and/orregistration signals, or any other appropriate kinds of signals. Radiotransmitter 1302 and radio receiver 1304 receive instructions andcommunicate data with the rest of cellular device 1300 via processor1306. Processor 1306 controls cellular device 1300. Processor 1306communicates with radio transmitter 1302 and radio receiver 1304, aswell as with memory 1310, subscriber identity module 1312, and display1314. Processor 1306 executes a set of instructions to control thedevice—for example, instructions in the form of software or code (e.g.,designated as cellular device software 1308 in FIG. 13). In someembodiments, cellular device software 1308 is stored in digital memory(e.g., random access memory, read only memory, programmable read onlymemory, memory 1310, or any other appropriate storage for storingsoftware for processing by a processor). Memory 1310 acts as temporaryand/or long-term information storage for processor 1306 as it iscontrolling cellular device 1300. Subscriber identity module (SIM) 1312comprises a removable module for an identifying number that cellulardevice 1300 uses to identify the user of cellular device 1300 to thenetwork. In one embodiment, SIM 1312 comprises SIM 311 of FIG. 5. Invarious embodiments, SIM 1312 stores an international subscriberidentity module (IMSI) number, an integrated circuit card identifier(ICCID) number, a serial number, or any other appropriate identifyingnumber. Display 1314 comprises a display for displaying information to auser. In various embodiments, information comprises device statusinformation, user interface information, diagnostic information, networkinformation, SMS information, or any other appropriate information.

In some embodiments, cellular device 1300 comprises a cellulardiagnostic device (e.g., cellular diagnostic device 1114 of FIG. 11),and cellular device software 1308 comprises cellular diagnosticsoftware. In various embodiments, cellular diagnostic software comprisessoftware for determining the status of a cellular network (e.g.,cellular network 1101 of FIG. 11), software for determining the statusof a cellular device (e.g., cellular device 100 of FIG. 11), softwarefor sending diagnostic messages to a cellular device, software fordisplaying the status of a cellular network, software for displaying thestatus of a cellular device, or any other appropriate cellulardiagnostic software. In some embodiments, cellular device software 1308comprises software for a network status display. In some embodiments,display 1314 comprises a diagnostic display. In various embodiments, adiagnostic display comprises a display for displaying the status of acellular network, a display for displaying the status of a cellulardevice, a display for displaying user interface information fordiagnostic software, or a display for any other appropriate diagnosticinformation. In some embodiments, display 1314 comprises a networkstatus display.

FIG. 14 is a block diagram illustrating an embodiment of a diagnosticdevice. In some embodiments, diagnostic device 1400 comprises diagnosticdevice 1120 of FIG. 11. In one embodiment, diagnostic device 1400comprises a control center 180, 280 comprising hosted service platform120 and CSP engines 125 (see FIGS. 1A, 1B) wherein processor 1406 andCSP engines 125 are equivalent. In the example shown, diagnostic device1400 comprises data transmitter 1402, data receiver 1404, processor1406, memory 1410, and diagnostic display 1412. Data transmitter 1402and data receiver 1404 communicate with a wireless network (e.g.,wireless cellular network 1101 of FIG. 11) via a data network (e.g.,external data network 1112 of FIG. 11). In some embodiments, diagnosticdevice 1400 uses data transmitter 1402 and data receiver 1404 tocommunicate with a cellular device (e.g., cellular device 100) via awireless network. In various embodiments, data transmitter 1402 and/ordata receiver 1404 communicate data signals, voice signals, text signals(e.g., short message service (SMS)), configuration and/or registrationsignals, or any other appropriate kinds of signals. Data transmitter1402 and data receiver 1404 receive instructions and communicate datawith the rest of diagnostic device 1400 via processor 1406. Processor1406 controls diagnostic device 1400. Processor 1406 communicates withdata transmitter 1402 and data receiver 1404, as well as with memory1410 and display 1412. Processor 1406 executes a set of instructions tocontrol the device—for example, instructions in the form of software orcode (e.g., designated as diagnostic device software 1408 in FIG. 14).In some embodiments, diagnostic device software 1408 is stored indigital memory (e.g., random access memory, read only memory,programmable read only memory, memory 1410, or any other appropriatestorage for storing software for processing by a processor). Memory 1410acts as temporary and/or long-term information storage for processor1406 as it is controlling diagnostic device 1400. Diagnostic display1414 comprises a display for displaying information to a user. Invarious embodiments, information comprises device status information,user interface information, diagnostic information, network information,SMS information, or any other appropriate information.

In various embodiments, diagnostic device software comprises softwarefor determining the status of a cellular network (e.g., cellular network1101 of FIG. 11), software for determining the status of a cellulardevice (e.g., cellular device 100 of FIG. 11), software for sendingdiagnostic messages to a cellular device, software for displaying thestatus of a cellular network, software for displaying the status of acellular device, or any other appropriate cellular diagnostic software.In some embodiments, diagnostic device software 1408 comprises softwarefor a network status display. In various embodiments, a diagnosticdisplay comprises a display for displaying the status of a cellularnetwork, a display for displaying the status of a cellular device, adisplay for displaying user interface information for diagnosticsoftware, or a display for any other appropriate diagnostic information.In some embodiments, display 1412 comprises a network status display.

FIG. 15A is a diagram illustrating an embodiment of a network diagnosticdisplay. In some embodiments, the network diagnostic display is part ofthe graphical user interface for displaying information of communicationdata streams as time-correlated lanes. In some embodiments, the networkdiagnostic display 1500 displays the status of cellular device 100 ofFIG. 11, identified by its SIM (e.g., SIM 1312 of FIG. 13). In someembodiments, network diagnostic display 1500 is displayed on adiagnostic device (e.g., cellular diagnostic device 1114 of FIG. 11 ordiagnostic device 1120 of FIG. 11), on a diagnostic display (e.g.,display 1314 of FIG. 13 or diagnostic display 1412 of FIG. 14). In theexample shown, network diagnostic display 1500 comprises displayed dataand user interaction controls. Displayed data comprises ICCID 1502, zoomdisplay 1512, date display 1516, time zone display 1520, dates 1528,mobile switching center (MSC) events data 1530, SGSN events data 1536,GSM Authorization requests data 1542, packet data protocol (PDP)sessions data 1544, SMS messages data 1546, PDP Context failures data1548, SIM status data 1550, and annotations data 1552. User interactioncontrols comprise send SMS button 1504, send cancel location 1506button, diagnose button 1508, SIM information button 1510, zoom menubutton 1514, date menu button 1518, time zone menu button 1522, refreshbutton 1524, show rows button 1526, add annotation button 1554, and OKbutton 1556.

ICCID 1502 comprises the ICCID for the SIM (e.g., SIM 1312 of FIG. 13)associated with the cellular device whose data is displayed in display1500. Dates 1528 comprise the dates over which data is displayed in thedata rows. The range of dates 1528 over which data is displayed isdisplayed in zoom display 1512 and can be modified by a user by clickingon zoom menu button 1514. In some embodiments, the available date rangescomprise 30 days, 14 days, 7 days, 3 days, 1 day, 12 hours, 4 hours, 30minutes, and 5 minutes. In various embodiments, available date rangesinclude any other date ranges, include date ranges input by the user, orinclude date ranges set in any other appropriate way. In someembodiments, the default date range is one day. In some embodiments, theuser interface also includes zoom in and zoom out buttons. Zoom in andzoom out buttons raise or lower the zoom level to the next appropriatezoom level with a single click by the user. In some embodiments, doubleclicking in a window is associated with a zoom in or zoom out command.The date upon which range of dates 1528 is centered is displayed in datedisplay 1516 and can be modified by a user by clicking on date menubutton 1518. In some embodiments, clicking and dragging on thebackground of display 1500 can modify the center of range of dates 1528.In some embodiments, range of dates 1528 defaults to display the mostrecently acquired data. The time zone to which range of dates 1528 isreferred is displayed in time zone display 1520 and can be modified by auser by clicking on time zone menu button 1522. In some embodiments, thetime zone to which range of dates 1528 is referred defaults to thecurrent time zone in the physical location of the user. Data displayedin display 1500 can be refreshed to the current time by clicking onrefresh button 1524.

In the example shown, display 1500 includes one or more rows of data.The rows of data can include MSC Events data 1530, SGSN Events data1536, GSM Authorization Requests data 1542, PDP Sessions data 1544, SMSMessages data 1546, Radius Failures data 1548, SIM Status data 1550, andAnnotations data 1552. A user can modify the set of rows displayed byclicking on show button 1526. Show button 1526 brings up a menu of datarows and allows the user to select whether each row should be displayed.MSC Events row 1530 displays location updates for any MSCs (e.g. MSC1202 of FIG. 12) on which the SIM has registered in the currentlydisplayed time range. If the SIM has registered with multiple MSCsduring the displayed time range, one sub-row (e.g., sub-row 1532 orsub-row 1534) is displayed for each MSC the SIM has registered with.Each MSC Events data sub-row displays shaded areas (e.g., shaded area1558) corresponding to times when the SIM has been registered with theassociated MSC. Each MSC Events data sub-row additionally displays icons(e.g., icon 1560) corresponding to points in time when an unmatchedregister or disconnect event is found (e.g., a register or disconnectevent without a disconnect or register event to match it to). SGSNEvents row 1536 displays location updates for any SGSNs (e.g., SGSN 1252of FIG. 12) on which the SIM has registered in the currently displayedtime range. If the SIM has registered with multiple SGSNs during thedisplayed time range, one sub-row (e.g., sub-row 1538 or sub-row 1540)is displayed for each SGSN the SIM has registered with. Each SGSN Eventsdata sub-row displays shaded areas (e.g., shaded area 1562)corresponding to times when the SIM has been registered with theassociated SGSN. Each SGSN Events data sub-row may additionally displayicons (e.g., icon 1564) corresponding to points in time when anunmatched register or disconnect event is found (e.g., a register ordisconnect event without a disconnect or register event to match it to).

GSM Authorization Requests data row 1542 displays GSM Authorizationrequests made during the displayed time range. A GSM Authorizationrequest is a connection request made to an HLR (e.g., HLR 1208 of FIG.12). The GSM Authorization Requests data row displays shaded areas(e.g., shaded area 1566) or colored areas corresponding to times whereGSM Authorization requests are made. The shade or color of the shaded orcolored area corresponds to the number of GSM Authorization requestsmade in the displayed time period. In some embodiments, a light shade ora green color corresponds to between 1 and 30 requests made in the timeperiod, a medium shade or a yellow color corresponds to between 31 and100 requests made in the time period, and a dark shade or a red colorcorresponds to more than 100 requests made in the time period.

PDP Sessions data row 1544 displays PDP sessions established for the SIMwithin the displayed time range. The PDP Sessions data row displaysshaded areas (e.g., shaded area 1568) corresponding to open PDP sessionsfor the SIM during the currently displayed time range. The PDP Sessionsdata row also displays boxes (e.g., box 1569) overlaid with the shadedareas corresponding to call detail records (CDR's) (e.g., CDR'sestablished by charging gateway function 1256 of FIG. 12). If multipleCDR's exist for a single PDP sessions, boxes corresponding to themultiple CDR's are drawn adjacent to one another. Open PDP session box1571 corresponds to a currently open PDP session, and open CDR session1573 corresponds to its associated open CDR. SMS Messages data row 1546displays SMS (e.g., short message service) messages sent to or from theSIM within the displayed time range. The SMS Messages data row displaysicons (e.g., icon 1570 or icon 1572) corresponding to sent or receivedSMS messages. In some embodiments, an empty or white icon (e.g., icon1570) corresponds to a sent SMS message and a filled or blue icon (e.g.,icon 1572) corresponds to a received SMS message. AuthenticationFailures data row 1548 displays failed attempts to establish datasessions during the time range. The Authentication Failures data rowdisplays shaded areas (e.g., shaded area 1574) or colored areascorresponding to failed attempts to establish data sessions. In someembodiments, a light shade or a green color corresponds to between 1 and10 authentication failures within a given time period, a medium shade ora yellow color corresponds to between 10 and 30 authentication failureswithin a given time period, and a dark shade or a red bar corresponds tomore than 30 authentication failures within a given time period.

SIM Status data row 1550 displays the ability of the SIM to establish adata session within the displayed time range. The SIM Status data rowdisplays shaded areas (e.g., shaded area 1576) or colored areascorresponding to the ability of the SIM to establish a data session. Insome embodiments, a light shade or a green color corresponds to the SIMhaving the ability to establish a data session, and a dark shade or ared color corresponds to the SIM not having the ability to establish adata session. Annotations data row 1552 displays notes describing eventhistory made at given points in time. The Annotations data row displaysicons (e.g., icon 1578, icon 1580, icon 1582, or icon 1584)corresponding to notes describing event history. In some embodiments, afilled or blue icon (e.g., icon 1584) corresponds to a manualannotation, an empty or white icon (e.g., icon 1578) corresponds toautomatically retrieved SIM information, a lightly shaded or green icon(e.g., icon 1580) corresponds to a diagnostic result with no expectedconnectivity issues, and a darkly shaded or red icon (e.g., icon 1582)corresponds to a diagnostic result with expected connectivity issues. Auser can add a manual annotation to Annotations data row 1552 byclicking Add button 1554.

A user of the display system can send an SMS message to the cellulardevice associated with the SIM by clicking Send SMS button 1504. Invarious embodiments, an SMS message can be used for communication withthe person possessing the cellular device, to test communication withthe cellular device, to send a diagnostic message to the device, or forany other appropriate purpose. A user of the display system can send acancel location message to the cellular device associated with the SIMby clicking Cancel Location button 1506. The cancel location messagecauses the cellular device to cancel its current MSC locationregistration. A user of the display system can start a diagnosticprocess on the cellular device associated with the SIM by clickingDiagnose button 1508. The diagnostic is an automatic process on thecellular device for determining connectivity problems. In someembodiments, the diagnostic process requires additional information fromthe user of the display system and prompts the user for the requiredinformation. The user can request attribute information from thecellular device associated with the SIM by clicking SIM Informationbutton 1510. Clicking the button displays the last known values of SIMattributes and allows the user to request them to be updated. In someembodiments, the SIM attributes comprise forbidden public land mobilenetworks (FPLMN), location information for the global packet radiosystem (LOCIGPRS), location information (LOCI,) and public land mobilenetwork selector (PLMNsel).

FIG. 15B is a diagram illustrating an embodiment of a table ofcommunication data stream information. In some embodiments, the table ofFIG. 15B is a table for displaying information extracted from one ormore communications data streams. In the example shown, the tableincludes column 1500 (e.g., with label Time), column 1502 (e.g., withlabel Event Type), column 1504 (e.g., with label Device), column 1506(e.g., with label Network Element), and column 1508 (e.g., with labelComments). The table includes row 1510 (e.g., with label 12:30 PM onJan. 1, 1901), row 1512 (e.g., with label 12:45 PM on Jan. 1, 1901), androw 1514 (e.g., with label 12:30 PM on Jan. 1, 1901), Column 1502entries are: A for row 1510, B for row 1512, and A for row 1514. Column1504 entries are: 1 for row 1510, 1 for row 1512, and 2 for row 1514.There are no entries for column 1508 in row 1510, row 1512, or row 1514.

FIG. 16 is a diagram illustrating an embodiment of a data popup window.In the example shown, data row 1600 is a data row (e.g., MSC Events datarow 1530 of FIG. 15A, SGSN Events data row 1536 of FIG. 15A, HLRRequests data row 1542 of FIG. 15A, PDP Sessions data row 1544 of FIG.15A, SMS Messages data row 1546 of FIG. 15A, Authentication Failuresdata row 1548 of FIG. 15A, SIM Status data row 1550 of FIG. 15A, orAnnotations data row 1552 of FIG. 15A). Data popup window 1602 displaysdata. In some embodiments, data row 1600 and data popup window 1602 arepart of a network diagnostic display (e.g., network diagnostic display1500 of FIG. 15A). In some embodiments, data popup window 1602 isdisplayed when a user clicks on an event in data row 1600. In someembodiments, data popup window 1602 displays attributes of the clickedevent. In the example shown, title 1604 comprises a title for a set ofattributes of a clicked event, and data1 1606 comprises a set ofattributes of a clicked event. Close box1 1608 causes the popup windowto close when it is clicked.

In some embodiments, data row 1600 comprises MSC Events data row 1530 ofFIG. 15. If a user clicks on a shaded area (e.g., shaded area 1558 ofFIG. 15A) in MSC Events data row 1530 of FIG. 15A, a popup window (e.g.,popup window 1602) is displayed. The title of the popup window comprisesthe global title (GT) address of the session, and the data in the popupwindow comprises the event type (e.g., “Location Update”), the carrier,the GT address, the IMSI number, the initial location update date andtime, and the cancel location date and time. If the user clicks on anicon (e.g., icon 1560 of FIG. 15A) in MSC Events data row 1530 of FIG.15A, a popup window is displayed. The title of the popup windowcomprises the GT address of the session, and the data in the popupwindow comprises the event type (e.g., “Location Update”), the carrier,the GT address, the IMSI number, and the event date and time.

In some embodiments, data row 1600 comprises SGSN Events data row 1536of FIG. 15A. If a user clicks on a shaded area (e.g., shaded area 1562of FIG. 15A) in SGSN Events data row 1536 of FIG. 15A, a popup window(e.g., popup window 1602) is displayed. The title of the popup windowcomprises the GT address of the session, and the data in the popupwindow comprises the event type (e.g., “Location Update”), the carrier,the GT address, the IMSI number, the initial location update date andtime, and the cancel location date and time. If the user clicks on anicon (e.g., icon 1564 of FIG. 15A) in SGSN Events data row 1536 of FIG.15A, a popup window is displayed. The title of the popup windowcomprises the GT address of the session, and the data in the popupwindow comprises the event type (e.g., “Location Update”), the carrier,the GT address, the IMSI number, and the event date and time.

In some embodiments, data row 1600 comprises GSM Authorization Requestsdata row 1542 of FIG. 15A. If a user clicks on a shaded area (e.g.,shaded area 1566 of FIG. 15A) in MSC Events data row 1530 of FIG. 15A, apopup window (e.g., popup window 1602) is displayed. The title of thepopup window comprises the number of GSM Authorization requests in thedisplayed time period, and the data in the popup window comprises theGSM Authorization request limit for the displayed color, the start dateand time for the displayed time period, and the end date and time forthe displayed time period.

In some embodiments, data row 1600 comprises PDP Sessions data row 1544of FIG. 15A. If a user clicks on a shaded area (e.g., shaded area 1568of FIG. 15A) in PDP Sessions data row 1544 of FIG. 15A, a popup window(e.g., popup window 1602) is displayed. The title of the popup windowcomprises the number of GSM Authorization requests in the displayed timeperiod, and the data in the popup window comprises the GSM Authorizationrequest limit for the displayed color, the start date and time for thedisplayed time period, and the end date and time for the displayed timeperiod. If a user clicks on a box corresponding to a CDR (e.g., box 1569of FIG. 15A), a popup window is displayed. The title of the popup windowcomprises the text “CDR”, and the data in the popup window comprises thecause for the CDR closing, the SGSN GT address, the number of uploadbytes during the CDR, the number of download bytes during the CDR, thesession duration, the CDR start date and time, and the CDR end date andtime.

In some embodiments, data row 1600 comprises SMS Messages data row 1546of FIG. 15A. If a user clicks on an icon (e.g., icon 1570 or icon 1572of FIG. 15A), a popup window (e.g., popup window 1602) is displayed. Thetitle of the popup window comprises the text “SMS MO” for an outgoingSMS message, and the title of the popup window comprises the text “SMSMT” for an incoming SMS message. The data in the popup window comprisesthe message status, the MSISDN to which the message was sent, the MSISDNfrom which the message was sent, and the date and time the message wassent.

In some embodiments, data row 1600 comprises Authentication Failuresdata row 1548 of FIG. 15A. If a user clicks on a shaded area (e.g.,shaded area 1574 of FIG. 15A), a popup window (e.g., popup window 1602)is displayed. The title of the popup window comprises the number ofauthentication failures in the displayed time period, and the data inthe popup window comprises the authentication failure limit for thedisplayed color, the start date and time for the displayed time period,and the end date and time for the displayed time period.

In some embodiments, data row 1600 comprises SIM Status data row 1550 ofFIG. 15A. If a user clicks on a shaded area (e.g., shaded area 1576 ofFIG. 15A), a popup window (e.g., popup window 1602) is displayed. Thetitle of the popup window comprises the text “SIM Status”, and the datain the popup window comprises the status of the SIM state at the timecorresponding to the click, the status of the suspended state at thetime corresponding to the click, the status of the overage limit at thetime corresponding to the click, the status of the overage limitoverride at the time corresponding to the click, the date and time whenthis combination of settings took effect, and the date and time whenthis combination of settings changed.

In some embodiments, data row 1600 comprises Annotations data row 1552of FIG. 15A. If a user clicks on an icon (e.g., icon 1578, icon 1580,icon 1582, or icon 1584 of FIG. 15A), a popup window (e.g., popup window1602) is displayed. The title of the popup window comprises the text“Annotation”, and the data in the popup window comprises the text of theannotation. The popup window additionally comprises links that allow auser to delete or edit the annotation.

FIG. 17A is a flow diagram illustrating an embodiment of a process forupdating a network status display in response to an MSC location updateevent. In some embodiments, the network status display is network statusdisplay 1500 of FIG. 15A. In the example shown, in 1700, an MSC locationupdate event is received. In 1702, it is determined if there is alreadya subrow in the network status display for the MSC associated with theMSC location update event. If there is not already a subrow in thenetwork status display for the MSC associated with the MSC locationupdate event, control passes to 1704, where a new subrow in the networkstatus display is created. The new subrow in the network status displayis for the MSC associated with the MSC location update event. Controlthen passes to 1706. If there is already a subrow in the network statusdisplay for the MSC associated with the MSC location update event,control passes directly to 1706. In 1706, a location update icon (e.g.,icon 1560 of FIG. 15A) is created in the subrow for the MSC associatedwith the MSC location update event (e.g., subrow 1532 of MSC Events datarow 1530 of FIG. 15A), and the process ends.

FIG. 17B is a flow diagram illustrating an embodiment of a process forupdating a network status display in response to an MSC location cancelevent. In some embodiments, the network status display is network statusdisplay 1500 of FIG. 15A. In the example shown, in 1700, an MSC locationcancel event is received. In 1752, it is determined if there is amatching location update. If there is a location update event that canbe matched to the location cancel event to form an MSC session, controlpasses to 1754. In 1754, the location update icon is converted to an MSCsession bar (e.g., MSC session bar 1558 of FIG. 15A). The MSC sessionbar begins at the point of the location update icon and ends at the timeassociated with the MSC location cancel event. If a matching locationupdate is not found in 1752, control passes to 1756. In 1756, it isdetermined if there is already a subrow in the network status displayfor the MSC associated with the MSC location cancel event. If there isnot already a subrow in the network status display for the MSCassociated with the MSC location cancel event, control passes to 1758,where a new subrow in the network status display is created. The newsubrow in the network status display is for the MSC associated with theMSC location cancel event. Control then passes to 1760. If there isalready a subrow in the network status display for the MSC associatedwith the MSC location cancel event, control passes directly to 1760. In1760, a location cancel icon (e.g., icon 1560 of FIG. 15A) is created inthe subrow for the MSC associated with the MSC location update event(e.g., subrow 1532 of MSC Events data row 1530 of FIG. 15A), and theprocess ends.

FIG. 18A is a flow diagram illustrating an embodiment of a process forupdating a network status display in response to an SGSN location updateevent. In some embodiments, the network status display is network statusdisplay 1500 of FIG. 15A. In the example shown, in 1800, an SGSNlocation update event is received. In 1802, it is determined if there isalready a subrow in the network status display for the SGSN associatedwith the SGSN location update event. If there is not already a subrow inthe network status display for the SGSN associated with the SGSNlocation update event, control passes to 1804, where a new subrow in thenetwork status display is created. The new subrow in the network statusdisplay is for the SGSN associated with the SGSN location update event.Control then passes to 1806. If there is already a subrow in the networkstatus display for the SGSN associated with the SGSN location updateevent, control passes directly to 1806. In 1806, a location update icon(e.g., icon 1564 of FIG. 15A) is created in the subrow for the SGSNassociated with the SGSN location update event (e.g., subrow 1540 ofSGSN Events data row 1546 of FIG. 15A), and the process ends.

FIG. 18B is a flow diagram illustrating an embodiment of a process forupdating a network status display in response to an SGSN location cancelevent. In some embodiments, the network status display is network statusdisplay 1500 of FIG. 15A. In the example shown, in 1800, an SGSNlocation cancel event is received. In 1852, it is determined if there isa matching location update. If there is a location update event that canbe matched to the location cancel event to form an SGSN session, controlpasses to 1854. In 1854, the location update icon is converted to anSGSN session bar (e.g., SGSN session bar 1562 of FIG. 15A). The SGSNsession bar begins at the point of the location update icon and ends atthe time associated with the SGSN location cancel event. If a matchinglocation update is not found in 1852, control passes to 1856. In 1856,it is determined if there is already a subrow in the network statusdisplay for the SGSN associated with the SGSN location cancel event. Ifthere is not already a subrow in the network status display for the SGSNassociated with the SGSN location cancel event, control passes to 1858,where a new subrow in the network status display is created. The newsubrow in the network status display is for the SGSN associated with theSGSN location cancel event. Control then passes to 1860. If there isalready a subrow in the network status display for the SGSN associatedwith the SGSN location cancel event, control passes directly to 1860. In1860, a location cancel icon (e.g., icon 1564 of FIG. 15A) is created inthe subrow for the SGSN associated with the SGSN location update event(e.g., subrow 1540 of SGSN Events data row 1546 of FIG. 15A), and theprocess ends.

FIG. 19 is a flow diagram illustrating an embodiment of a process forupdating a network status display in response to a GSM Authorizationrequest. In some embodiments, the network status display is networkstatus display 1500 of FIG. 15A. In the example shown, in 1900, a GSMAuthorization request is received. In 1902, the GSM Authorizationrequest count is incremented for this time period. In 1904, the GSMAuthorization request count is checked to see if there are between 1 and30 GSM Authorization requests in this time period. If there are between1 and 30 GSM Authorization requests in this time period, control passesto 1906. In 1906, a green GSM Authorization request bar (e.g., GSMAuthorization request bar 1566 of FIG. 15A) is drawn for this timeperiod in the GSM Authorization Requests data row (e.g., GSMAuthorization Requests data row 1542 of FIG. 15A), and the process ends.If there are not between 1-30 GSM Authorization requests in this timeperiod, control passes to 1908. In 1908, the GSM Authorization requestcount is checked to see if there are between 31 and 100 GSMAuthorization requests in this time period. If there are between 31 and100 GSM Authorization requests in this time period, control passes to1910. In 1910, a yellow GSM Authorization request bar is drawn for thistime period in the GSM Authorization Requests data row, and the processends. If there are not between 31-100 GSM Authorization requests in thistime period, control passes to 1912. In 1912, there must be more than100 GSM Authorization requests in this time period. A red GSMAuthorization request bar is drawn for this time period in the GSMAuthorization Requests data row, and the process ends.

FIG. 20A is a flow diagram illustrating an embodiment of a process forupdating a network status display in response to a PDP session startevent. In some embodiments, the network status display is network statusdisplay 1500 of FIG. 15A. In the example shown, in 2000, a PDP sessionstart event is received. In 2002, an open PDP session bar and CDRsession bar (e.g., open PDP session bar 1571 of FIG. 15A) are drawn inthe PDP sessions data row (e.g., PDP sessions data row 1544 of FIG.15A), and the process ends.

FIG. 20B is a flow diagram illustrating an embodiment of a process forupdating a network status display in response to a PDP session endevent. In some embodiments, the network status display is network statusdisplay 1500 of FIG. 15A. In the example shown, in 2020, a PDP sessionend event is received. In 2022, a closed PDP session bar and CDR sessionbar (e.g., PDP session bar 1568 of FIG. 15A) are drawn in the PDPsessions data row (e.g., PDP sessions data row 1544 of FIG. 15A), andthe process ends.

FIG. 20C is a flow diagram illustrating an embodiment of a process forupdating a network status display in response to a CRD session endevent. In some embodiments, the network status display is network statusdisplay 1500 of FIG. 15A. In the example shown, in 2040, a CDR sessionend event is received. In 2042, a closed CDR session bar (e.g., closedCDR session bar 1569 of FIG. 15A) and a new open CDR session bar (e.g.,open CDR session bar 1573 of FIG. 15A) are drawn in the PDP sessionsdata row (e.g., PDP sessions data row 1544 of FIG. 15A), and the processends.

FIG. 21A is a flow diagram illustrating an embodiment of a process forupdating a network status display in response to a SMS message receivedevent. In some embodiments, the network status display is network statusdisplay 1500 of FIG. 15A. In the example shown, in 2100, a SMS messagesent event is received. In 2102, a white icon (e.g., icon 1570 of FIG.15A) is drawn in the SMS Messages received data row (e.g., SMS Messagesreceived data row 1546 of FIG. 15A), and the process ends.

FIG. 21B is a flow diagram illustrating an embodiment of a process forupdating a network status display in response to a SMS message sentevent. In some embodiments, the network status display is network statusdisplay 1500 of FIG. 15A. In the example shown, in 2120, a SMS messagereceived event is received. In 2122, a blue icon (e.g., icon 1572 ofFIG. 15A) is drawn in the SMS Messages received data row (e.g., SMSMessages received data row 1546 of FIG. 15A), and the process ends.

FIG. 22 is a flow diagram illustrating an embodiment of a process forupdating a network status display in response to an authenticationfailure event. In some embodiments, the network status display isnetwork status display 1500 of FIG. 15A. In the example shown, in 2200,an authentication failure event is received. In 2202, the authenticationfailure count is incremented for this time period. In 2204, theauthentication failure count is checked to see if there are between 1and 10 authentication failures in this time period. If there are between1 and 10 authentication failures in this time period, control passes to2206. In 2206, a green authentication failure bar (e.g., authenticationfailure bar 1574 of FIG. 15A) is drawn for this time period in theAuthentication Failures data row (e.g., Authentication Failures data row1548 of FIG. 15), and the process ends. If there are not between 1-10authentication failures in this time period, control passes to 1208. In1208, the authentication failures count is checked to see if there arebetween 11 and 30 authentication failures in this time period. If thereare between 11 and 30 authentication failures in this time period,control passes to 2210. In 2210, a yellow authentication failure bar isdrawn for this time period in the Authentication Failures data row, andthe process ends. If there are not between 11-30 authentication failuresin this time period, control passes to 2212. In 2212, there must be morethan 30 authentication failures in this time period. A redauthentication failures bar is drawn for this time period in theAuthentication Failures data row, and the process ends.

FIG. 23 is a flow diagram illustrating an embodiment of a process forupdating a network status display with the current SIM status. In someembodiments, the network status display is network status display 1500of FIG. 15A. In the example shown, in 2300, the SIM status is checked todetermine if the SIM is allowed to establish a data session. If the SIMis allowed to establish a data session, control passes to 1302. In 2302,a green SIM status bar (e.g., SIM status bar 1576 of FIG. 15A) is drawnin the SIM Status data row (e.g., SIM Status data row 1550 of FIG. 15A),and the process ends. In 2300, if the SIM is determined to not beallowed to establish a data session, control passes to 2304. In 2304, ared SIM status bar is drawn in the SIM Status data row, and the processends.

FIG. 24 is a flow diagram illustrating an embodiment of a process forupdating a network status display in response to an annotation event. Insome embodiments, the network status display is network status display1500 of FIG. 15A. In the example shown, in 2400, a new annotation eventis received. In 2402, the annotation is checked to see if it is manuallyadded. If the annotation was determined to be manually added, controlpasses to 2404. In 2404, a blue annotation icon (e.g., annotation icon1584 of FIG. 15A) is drawn in the Annotations data row (e.g.,Annotations data row 1552 of FIG. 15), and the process ends. If theannotation was not determined to be manually added in 2402, controlpasses to 2406. In 2406, the annotation is checked to see if it isautomatically retrieved SIM information. If the annotation is determinedto be automatically retrieved SIM information, control passes to 2408.In 2408, a white annotation icon (e.g., annotation icon 1578 of FIG.15A) is drawn in the Annotations data row, and the process ends. If theannotation is not determined to be automatically retrieved SIMinformation in 2406, control passes to 2410. In 2410, the annotation ischecked to see if it is a diagnostic result with no expectedconnectivity issues. If the annotation is determined to be a diagnosticresult with no expected connectivity issues, control passes to 2412. In2412, a green annotation icon (e.g., annotation icon 1580 of FIG. 15A)is drawn in the Annotations data row, and the process ends. If theannotation is not determined to be a diagnostic result with no expectedconnectivity issues, control passes to 2414. The annotation is thendetermined to be a diagnostic result with expected connectivity issues.In 2414, a red annotation icon (e.g., annotation 1582 of FIG. 15A) isdrawn in the Annotations data row, and the process ends.

FIG. 25 is a flow diagram illustrating an embodiment of a process for anetwork status display to respond to a send SMS button click event. Insome embodiments, the network status display is network status display1500 of FIG. 15A. In some embodiments, the send SMS button is send SMSbutton 504 of FIG. 15A. In the example shown, in 2500, a send SMS buttonclick event is received. In 2502, the network status display user isprompted for the SMS text. In 2504, the SMS text is received. In 2506,an SMS is sent to the cellular device associated with the network statusdisplay (e.g., cellular device 100 of FIG. 1) containing the receivedtext, and the process ends.

FIG. 26 is a flow diagram illustrating an embodiment of a process for anetwork status display to respond to a send cancel location button clickevent. In some embodiments, the network status display is network statusdisplay 1500 of FIG. 15A. In some embodiments, the send cancel locationbutton is send cancel location button 1506 of FIG. 15A. In the exampleshown, in 2600, a send cancel location button click event is received.In 2602, a cancel location message is sent to the cellular deviceassociated with the network status display (e.g., cellular device 100 ofFIG. 11), and the process ends.

FIG. 27 is a flow diagram illustrating an embodiment of a process for anetwork status display to respond to a diagnose button click event. Insome embodiments, the network status display is network status display1500 of FIG. 15A. In some embodiments, the diagnose button is diagnosebutton 1508 of FIG. 15A. In the example shown, in 2700, a diagnosebutton click event is received. In 2702, a connectivity diagnosticwizard is launched by the network status display. In some embodiments,the connectivity diagnostic wizard contains automated logic forassessing the ability to connect of the cellular device associated withthe network status display (e.g., cellular device 100 of FIG. 11). In2704, the user is prompted for more information, if necessary, and theprocess ends.

FIG. 28 is a flow diagram illustrating an embodiment of a process for anetwork status display to respond to a SIM information button clickevent. In some embodiments, the network status display is network statusdisplay 1500 of FIG. 15A. In some embodiments, the SIM informationbutton is SIM information button 1510 of FIG. 15A. In the example shown,in 2800, a SIM information button click event is received. In 2802, SIMinformation is displayed. In some embodiments, SIM information comprisesvalues for a forbidden public land mobile network (FPLMN), locationinformation for general packet radio service (LOCIGPRS), locationinformation (LOCI), and a public land mobile network selector (PLMNsel).The network status display user may then request the SIM information tobe updated. In 1804, the SIM information is updated, if necessary, andthe process ends.

FIG. 29 is a flow diagram illustrating an embodiment of a process for anetwork status display to respond to a zoom menu button click event. Insome embodiments, the network status display is network status display1500 of FIG. 15A. In some embodiments, the zoom menu button is zoom menubutton 1514 of FIG. 15A. In the example shown, in 2900, a zoom menubutton click event is received. In 2902, the zoom menu is displayed. Thezoom menu comprises one or more possible zoom levels at which the datain the network status display can be displayed. In some embodiments, thepossible zoom levels comprise 30 days, 14 days, 7 days, 3 days, 1 day,12 hours, 4 hours, 30 minutes, and 5 minutes. In 2904, a zoom menuselection is received. In 2906, the data display is redrawn at thedesired zoom level, and the process ends.

FIG. 30 is a flow diagram illustrating an embodiment of a process for anetwork status display to respond to a date menu button click event. Insome embodiments, the network status display is network status display1500 of FIG. 15A. In some embodiments, the date menu button is date menubutton 1518 of FIG. 15A. In the example shown, in 3000, a date menubutton click event is received. In 3002, the date menu is displayed. Thedate menu comprises one or more possible dates around which the data inthe network status display can be centered. In 3004, a date menuselection is received. In 3006, the data display is redrawn centered onthe desired date, and the process ends.

FIG. 31 is a flow diagram illustrating an embodiment of a process for anetwork status display to respond to a time zone menu button clickevent. In some embodiments, the network status display is network statusdisplay 1500 of FIG. 15A. In some embodiments, the time zone menu buttonis time zone menu button 1522 of FIG. 15A. In the example shown, in3100, a time zone menu button click event is received. In 3102, the timezone menu is displayed. The zoom menu comprises one or more possibletime zones to which the times in the network status display can bereferred. In 3104, a time zone menu selection is received. In 3106, thedata display is redrawn with times referred to the desired time zone,and the process ends.

FIG. 32 is a flow diagram illustrating an embodiment of a process for anetwork status display to respond to a refresh button click event. Insome embodiments, the network status display is network status display1500 of FIG. 15A. In some embodiments, the refresh button is refreshbutton 1524 of FIG. 15A. In the example shown, in 3200, a refresh buttonclick event is received. In 3202, updated data is collected. In variousembodiments, updated data is collected from the cellular deviceassociated with the network status display. (e.g., cellular device 100of FIG. 11), from the wireless cellular network (e.g., wireless cellularnetwork 1101 of FIG. 11), or from any other appropriate device. In 3204,the data display is redrawn with the updated data, and the process ends.

FIG. 33 is a flow diagram illustrating an embodiment of a process for anetwork status display to respond to an OK button click event. In someembodiments, the network status display is network status display 1500of FIG. 15A. In some embodiments, the OK button is OK button 1556 ofFIG. 15A. In the example shown, in 3300, an OK button click event isreceived. In 3302, the network status display is closed, and the processends.

FIG. 34 is a flow diagram illustrating an embodiment of a process for asystem for diagnosing wireless communication systems. In someembodiments, the process of FIG. 34 is implemented using diagnosticsoftware 1408 of FIG. 14 and executed using processor 1406 of FIG. 14.In some embodiments, a mobile diagnostic device implements the processof FIG. 34 using software (e.g., 1308 of FIG. 13) and executes theprocess using a processor (e.g., 1306 of FIG. 13). In the example shown,in 3400 one or more communication data log(s) or stream(s) are received.In some embodiments, communication data log(s) or streams(s) come from aplurality of communication systems. In various embodiments, a pluralityof communication systems comprises one or more of an HLR system, aradius system, an SMSC system, a SIM system, an MSC system, an SGSNsystem, a GSM Authorization request system, an authentication failuresystem, a data session system, a PDP system, or an SMS system. Invarious embodiments, communication data log(s) or stream(s) comprise HLRlog(s) or stream(s), radius accounting log(s) or stream(s), shortmessage service center (SMSC) log(s) or stream(s), SIM audit traillog(s) or stream(s), or any other appropriate log(s) or stream(s). Invarious embodiments, data extracted from HLR log(s) or stream(s)comprises MSC location history, SGSN location history, GSM Authorizationrequest history, authentication failure history, or any otherappropriate data. In various embodiments, data extracted from radiusaccounting log(s) or stream(s) comprises data session history (e.g., PDPcontexts), or any other appropriate data. In various embodiments, dataextracted from SMSC log(s) or stream(s) comprises SMS message history,or any other appropriate data. In various embodiments, data extractedfrom SIM audit trail log(s) or stream(s) comprises SIM status history,or any other appropriate data. In some embodiments, the processor isalso for combining the one or more communications data log(s) orstream(s). In some embodiments, the processor is also for correlatingthe one or more communications data log(s) or stream(s).

In 3402, data (e.g. information) is extracted from the one or morecommunication data log(s) or stream(s). In 3404, extracted data (e.g.,information) is displayed as a plurality of time-correlated lanes. Forexample, data is displayed using swim lanes or pop ups of a diagnosticdisplay (e.g., a display like in FIG. 15A). In various embodiments, swimlanes have information displayed as shaded or colored bars and/or shadedor colored point events, or any other appropriate display ofinformation. In some embodiments, data (e.g., information) is displayedas plurality of time-correlated lanes in a graphical user interface. Insome embodiments, displaying information as a plurality oftime-correlated lanes is managed by a role-based access controlprotocol. In some embodiments, access control for displaying informationas a plurality of time-correlated lanes is based at least in part of anorganization associated with a user.

In some embodiments, the graphical user interface is also for providinga control for changing a time zone associated with the displayedinformation. For example, a user selects that all times associated withlanes of displayed information are displayed in local time to a wirelesscellular device, in local time for a user, in Greenwich Mean Time (GMT),or any other appropriate time. In some embodiments, the graphical userinterface is also for providing a control for changing a time scaleassociated with the displayed information. For example, the time scaleis set to show information within a few hours, one hour, a day, a halfday, or any other appropriate time scale. In some embodiments, providinga control for changing a time scale includes providing a control forzooming in or zooming out, and/or a control for displaying theinformation at multiple time-scales (e.g., some sections with longertime scales and some sections with shorter time scales—a zoomed insection). In some embodiments, the graphical user interface is also forproviding a control for displaying by a desired time or a desired date.In some embodiments, the graphical user interface is also for providinga control for displaying by scrolling or panning a time windowassociated with the desired information. In some embodiments, a controlfor displaying by scrolling or panning is provided for ease ofnavigation. In some embodiments, a click in a window centers a display(e.g., a click on a time centers the time in the window). In someembodiments, the graphical user interface is also for providing acontrol for a user to add a time-based annotation (e.g., a note ofexplanation). In some embodiments, the graphical user interface is alsofor providing a control for a user to edit a time-based annotation. Insome embodiments, the graphical user interface is also for providing acontrol for a user to share a time-based annotation. In someembodiments, the graphical user interface is also for providing acontrol for selecting a format for displaying the information, whereinthe format comprises one or more of the following: Event format (e.g.,displays icons corresponding to events, e.g. icon 1560 of FIG. 15A),Time bar format (e.g., displays time bars corresponding to events withduration, e.g. shaded area 1558 of FIG. 15A), Heat map format (e.g.,displays bars colored or patterned or shaded or grey-scaled tocorrespond to density of events, e.g. shaded area 1566 of FIG. 15A), andAnnotations (e.g., icons corresponding to human or machine createdannotations, e.g. icon 1578 of FIG. 15A). In some embodiments, theformat adjusts automatically depending on the data content. In variousembodiments, the format adjusts automatically by switching from oneformat to another format (e.g., from Event format to Heat map format orfrom Time bar format to Event format), by automatically scaling the timeaxis, by automatically scaling the density of events displayed, byautomatically changing the color of the bars in the Heat map format, byautomatically changing the size or shape of the icons in Event format orany other display feature, or in any other appropriate way. In someembodiments, the graphical user interface is also for providing acontrol for displaying additional information in response to a userclick or hover. In some embodiments, a user click or hover causes aninteraction with a server to obtain the additional information. In someembodiments, the graphical user interface is also for providing acontrol for selecting one or more time correlated lanes of the pluralityof time-correlated lanes to display or hide. In some embodiments,information from one of the plurality of communication systems isdisplayed or associated with more than one of the plurality oftime-correlated lanes. In some embodiments, a user selects which of theplurality of time-correlated lanes the information is associated with.In some embodiments, a selection of which of the plurality oftime-correlated lanes the information is associated with is based atleast in part on distinguishing attributes of the information displayed.In some embodiments, a user selects one or more criteria for decidingwhich of the plurality of time-correlated lanes each of the informationelements is associated with and the associating is achievedautomatically based at least in part on the one or more criteria. Invarious embodiments, distinguishing attributes of information displayedcomprise time since information update, total information received inthe displayed time period, total information received in a user definedtime period, access control properties of the display user, externallydefined information priority, or any other appropriate attributes. Insome embodiments, the graphical user interface is also for providing acontrol for searching for a specific pattern in one or more of theplurality of time-correlated lanes. In some embodiments, the graphicaluser interface is also for providing a control for filtering out aspecific pattern in one or more of the plurality of time-correlatedlanes. In some embodiments, the graphical user interface is also forautomatically highlighting a specific pattern in one or more of theplurality of time-correlated lanes. In some embodiments, the graphicaluser interface is also for automatically adding an annotation to aspecific pattern in one or more of the plurality of time-correlatedlanes.

In some embodiments, the graphical user interface is also for providingan active control. In some embodiments, the active control comprisessends an SMS message, wherein the sent SMS message sends a text messageto a SIM. In some embodiments, the active control comprises a controlthat when activated sends a cancel location command, wherein the cancellocation command sends a cancel location command to a SIM. In someembodiments, the active control comprises a control that when activatedsends a diagnose command, wherein the diagnose control assess a SIM'sability to connect to a wireless network. In various embodiments, theactive control comprises a control that when activated retrieves SIMinformation from one or more of the following: a SIM, a SIM database, aHLR, or any other appropriate SIM information source. In variousembodiments, SIM information comprises one or more of the following:last known value or last update date or time for a SGSN, a MSC, a FPLMN,A LOCIGPRS, a LOCI, or any other appropriate SIM information. In someembodiments, an active control comprises an update (e.g., an update fora value associated with a SGSN, a MSC, a FPLMN, A LOCIGPRS, a LOCI,etc.).

In some embodiments, the display also includes active controls—forexample, send SMS, send cancel location, diagnose, SIM information.

Different embodiments of the invention may be implemented usingdifferent combinations of software, firmware, and/or hardware. Thus, thetechniques shown in the figures can be implemented using code and datastored and executed on one or more electronic devices (e.g., computers,servers, mobile devices, etc.). Such electronic devices store andtransmit (internally and/or with other electronic devices over anetwork) code (composed of software instructions) and data usingcomputer-readable media, such as non-transitory tangiblecomputer-readable media (e.g., computer-readable storage media such asmagnetic disks; optical disks; read only memory; flash memory devices)and transitory computer-readable transmission media (e.g., electrical,optical, acoustical or other form of propagated signals—such as carrierwaves, infrared signals). In addition, such electronic devices typicallyinclude a set of one or more processors coupled to one or more othercomponents, such as one or more non-transitory machine-readable media(to store code and/or data), user input/output devices (e.g., akeyboard, a touchscreen, and/or a display), and network connections (totransmit code and/or data using propagating signals). The coupling ofthe set of processors and other components is typically through one ormore busses and bridges (also termed as bus controllers). Thus, anon-transitory computer-readable medium of a given electronic devicetypically stores instructions for execution on one or more processors ofthat electronic device. One or more parts of an embodiment of theinvention may be implemented using different combinations of software,firmware, and/or hardware.

While the invention has been described in terms of several embodiments,those skilled in the art will recognize that the invention is notlimited to the embodiments described and can be practiced withmodification and alteration within the spirit and scope of the appendedclaims. The description is thus to be regarded as illustrative insteadof limiting.

What is claimed is:
 1. A system comprising a signal transfer point (STP)node for managing aggressive behavior of a wireless device in a wirelessnetwork, the STP node comprising: a STP processor; and a STP memorycoupled with the STP processor to store a plurality of routinginstructions, and to further store, on a per wireless device basis, awireless device signature and a rule set, both of which are indexed by awireless device identifier, wherein the wireless device signaturedefines an aggressive behavior of the wireless device that repeatedlyretries to perform a network signaling in a time frame such that athreshold for the retries is exceeded, and wherein the routinginstructions direct transmission of wireless device signals on a perwireless device basis, the STP memory configured to provide the STPprocessor with instructions which when executed cause the STP processorto perform STP operations to: determine an aggressive behavior data ofreceived wireless signals that are transmitted from the wireless deviceto the STP node; determine the rule set for the received wirelesssignals, wherein the rule set comprises first logic to compare thewireless device signature to the aggressive behavior data of thereceived wireless signals, and second logic to provision one of therouting instructions in the STP memory; identify, in accordance with thefirst logic in the rule set, presence of the aggressive behavior of thewireless device; provision, in accordance with the second logic in therule set, to modify the one of the routing instructions in the STPmemory to control a transmission function of the STP node for thereceived wireless signals; and perform real-time throttling,re-directing or blocking of the received wireless signals that areidentified according to the first logic as aggressive behavior signalsutilizing the one of the modified routing instructions provisioned inthe STP memory.
 2. The system of claim 1, wherein the wireless deviceidentifier is an International Mobile Subscriber Identity (IMSI) or anMSISDN.
 3. The system of claim 1, wherein the STP node identifies theaggressive behavior signals when the wireless device generates more thana threshold number of authentication failures per time unit.
 4. Thesystem of claim 1, wherein the STP node identifies the aggressivebehavior signals when the wireless device sends more than a thresholdnumber of authentication requests in a time period towards a HLR.
 5. Thesystem of claim 1, wherein the STP node identifies the aggressivebehavior signals when the wireless device generates more than athreshold number of Packet Data GGSN Call Data Records (G-CDR) in a timeperiod.
 6. The system of claim 1, wherein the rule set is adapted todifferent field behaviors of different categories of wireless devices.7. The system of claim 1, wherein the rule set specifies an allowablefrequency and allowable successive number of times for the wirelessdevice to retry for the network signaling.
 8. A method utilizing asignal transfer point (STP) node for managing aggressive behavior of awireless device in a wireless network, the method comprising: providingthe STP node comprising: a STP processor; and a STP memory coupled withthe STP processor to store a plurality of routing instructions, and tofurther store, on a per wireless device basis, a wireless devicesignature and a rule set, both of which are indexed by a wireless deviceidentifier, wherein the wireless device signature defines an aggressivebehavior of the wireless device that repeatedly retries to perform anetwork signaling in a time frame such that a threshold for the retriesis exceeded, and wherein the routing instructions direct transmission ofwireless device signals on a per wireless device basis, the STP memoryconfigured to provide the STP processor with instructions which whenexecuted cause the STP processor to perform STP operations to: determinean aggressive behavior data of received wireless signals that aretransmitted from the wireless device to the STP node; determine the ruleset for the received wireless signals, wherein the rule set comprisesfirst logic to compare the wireless device signature to the aggressivebehavior data of the received wireless signals, and second logic toprovision one of the routing instructions in the STP memory; identify,in accordance with the first logic in the rule set, presence of theaggressive behavior of the wireless device; provision, in accordancewith the second logic in the rule set, to modify the one of the routinginstructions in the STP memory to control a transmission function of theSTP node for the received wireless signals; and perform real-timethrottling, re-directing or blocking of the received wireless signalsthat are identified according to the first logic as aggressive behaviorsignals utilizing the one of the modified routing instructionsprovisioned in the STP memory.
 9. The method of claim 8, wherein thewireless device identifier is an International Mobile SubscriberIdentity (IMSI) or an MSISDN.
 10. The method of claim 8, wherein the STPnode identifies the aggressive behavior signals when the wireless devicegenerates more than a threshold number of authentication failures pertime unit.
 11. The method of claim 8, wherein the STP node identifiesthe aggressive behavior signals when the wireless device sends more thana threshold number of authentication requests in a time period towards aHLR.
 12. The method of claim 8, wherein the STP node identifies theaggressive behavior signals when the wireless device generates more thana threshold number of Packet Data GGSN Call Data Records (G-CDR) in atime period.
 13. The method of claim 8, wherein the rule set is adaptedto different field behaviors of different categories of wirelessdevices.
 14. The method of claim 8, wherein the rule set specifies anallowable frequency and allowable successive number of times for thewireless device to retry for the network signaling.